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Subject: FW: Phone Records 


a . t s 


Subject: RE: Phone Records 


NON-RECORD 7 UNCLASSlFIEP 


JWF) (FBI)j I (OTD) (FBI)| 

If CTDI (FBI); HQ-DIV13-EOPS_TECH 


A short list would include/ 

1. Provide automated uploading from DCS-3000 to telephone applications. 


2. Currently, we cannot upload pen regis 
the intercept. Nearly all Establishments us< 


3. Provide automated uploading from th< 


tion frorrj 

for telephone service. 


Jlines using an Ice Storm for 


Election system to telephone applications. 


|CTD) (CON) 
fi_2a_2D05 4:45 PM 
KWF) (FBI) 


ALL INFORMATION COMTAIHED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD /KSR/MAJ 


. ^'^Message 


Page 2 of 2 


b 6 cc: \ I rcrDI (FBI);| [cTD) (FBI); HQ-DIV13-E0PS_TECH 

k 7 c Subject: Phone Records 


b2 

b6 

b7C 

b7E 


SENSITIVE BUT UNCLASSIFIED 
N ON-RECORp 



asked me to contact you regarding an issue of transferring massive amounts of DNR data 
| Can you send me an email with details of the issues? Anything you can provide will be 


Thanks, 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSI FIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSI FIED 


10/4/2006 



Message 


][OTD) (FBI) 


From: 1= |OTD) (FBI) 

Sent: Tuesday, August 09, 2005 2:42 PM 

To: I l (OTD ) (FBI)r 

Cc: I I OTP) (FBI); | 


(FBI) 

Subject: RE: RMS Request 

UN CLASSIF IED 

NON-RECORD 






TICTU is handling another Service Request^ 


Page 1 of 2 


b6 

b7C 


I OTD) (CON) 
DTD) (FBl£ 


rom Sacramento that reads, as follows: 


H(OTD) 


b2 

b6 

b7C 

b7E 


"Sacramento would like to request a DCS 3000 computer for our Modesto RA, so the RA will be able to use the 
tracker program We also need a router for the Modesto RA, we will have the DCS use one channel of a T-1 that 
goes from the Modesto RA to the Sacramento office.” 


^ndicates that \ S hould be handled by your unit, with respect to the channel banks and T1 


RMO Program Manager 
ELSUR Technical Management Unit 
Electronic SuijieiUaflcalfi^pnology Section, OTD 
Phone: (70^ 

Cell: {202)| 

Fax: (703)|. 


b2 

b6 

b7C 


Original Message- 

From: 

Sent: 

To: 1- 

Cc: 

Subject: RMS Request #[ 



itaa^ (FBI) 


OTD) (FBI) 


uncla ssified 

N QN-REC QBD 


b6 

b7C 


ATU/HAT received the above referenced request from Sacramento. This request is for assistance 
in setting up a telecommunications circuit (T-1), not for assistance in intercepting the circuit. ATU/H/ 
does interc epts. This should not have been directed to ATU/HAT. I believe this request should go to| 




bo 

UNCLASSIFIED b7C 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD/KSR/HAJ 


10/4/2006 



Page 2 of 2 


Message 

UNCLASSIFIED 


10/4/2006 


Page 1 of 2 


| (OTP) (FBI) 

From: | ‘ 1 (OTD)(CON) on behalf of[ 

Sent: Friday, October 14, 2005 3:28 PM 

To: |(OTD) (FBI) l 

Cc: I fOTDHFBnl 


|(OTD) (FB I) 

l(CQ) (FBI);[ 


Subject: FW: TACC 


UNC LASS IF IED 

NON-RECOR D 


I checked with ! | on this request. He 

are familiar with the folks making the request anq 


\e to send this tq 

had done the install tor them. 


O riginal Messaqe- 

Froml 


| (OTD) (FBI) 
2_2p05 2:47 PM 
~J(OTD) (FBI) 


This request falls into ATU. Could you please contactl Ito provide assistance. 


[NO) (FBI) 

tober 13, 2005 10:31 AM 

IfOTDH FBI) 

If NO ) (FBI)I 
tNO) (FBI)l 


, l(NO) (FBI); b7c 

JNOHFBI) 


UNCLASSIFIED 

NON-B E.CORD 


I don't know who to send this to so I am going to you with this. With our situation down here, 
(Shreveport and Monroe) have picked up handling all of our TESUR requirments (DCS 3000,j 


10 / 4/2006 


b2 

blE 


Page 2 of 2 


b 2 • • Message 
b7E ■ 

What I need up there now is a l I for consensual phone calls. Our HQ citv l L as placed in storage (piled 
in with all other computers) when our bldg was emptied Bef ore I submit an RMS, is it possible to get one sent to 
one of these RAs? We do have a full-time TTA| [assigned up there. 



UNCLASSIFIED 


UNCLASSIFIED 


10/4/2006 


From: 

Sent: 


Cc: 

Subject: 


"l(OTPHFBI) 

1= 


1 t OlUj'lFHI,. 

DEMOS Thursday (6/22) 


loTD) (FBI) 

4.17 PM _ 

l(OTD)(CON|_ 

ZPON) _ 

JrQTDWCQNlI 


IOTBTTc oni 


JotbwpbC 


3 otd h con )C 

1 tmn\ /FRhl 


□ 


JOTD) (FBI) 


UNCLASSIFIED 


All, 

You're invited to attend a short demo with the following groups this Thursday (6/22): 

1) 0900 - DCS-6000 Labi [ 

2) 0930 - Traditional Lab| , 1 , 

3) 1 000 - CSOC Help De sk lienterl I b 6 

4) 1 030 - DCS-3000 Lab J I b 7 C 

5) High Capacity Lat j | next week TBD 


Thnx, 

-ca 


UNCLASSIFIED 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DHD/KSR/HAJ 



bo 

b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 


U(OTD)(FBI) 


Tufifirifly June 2P. 2QQ6 3:44 pm 

~(SF) (FBI) 

^JOTD) (FBI);[_ 




]OTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 




didn’t fix anything. I will cross it off the "to do" list for today. As for the 800 number, I don't know if we have 
ever tried to apply CALEA type intercepts to 800 numbers. If it is part of a trunk group it will not work. My understanding 
of what the CALEA software the government bought can be applied to is limited to direct dedicated appearance type 
phone service. The best people to ask as to how the phone number service is set up and whether CALEA can be used 
on 

it is SBC. Let me know if you want me to be in on any calls with them. It is a learning experience on some of these 
applications 
of CALEA to hardlines. 


□ 

Subject: 

UNCLASSIFIED 

NON-RECORD 


SF) (FBI) 
2:10 PM 
)TD) (FBI) 


b2 

b6 

b7C 

b7E 




If you've done something thanks, otherwise disregard. It appears 1 was getting no pen on one line, but the other four 
have pen from 5/5/06. 

But, not to let you get off too fast. Where do 1 go to 
hardline of SBC? 

get some info to do a pen on an 800 number that rides on a 

From: | ! 

|sF) (FBI) 

*06 12’30 PM 



S-«. 

toTDHFBI) 



Cc: 1 

_HJSF) (FBI) 

b2 

b6 

b7C 

ALL INFORMATION CONTAINED 

HEBEIN 15 UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD/KSR/MAJ 

Subject: 9.6 CDC 

UNCLASSIFIED 

NON-RECORD 


Hi| 1 


b7E 



I've attached photos of our rack holding the DCS30 0Q rou ter and routers used for the col lection of the CPC fro m SBC 
via the 9.6 delivery. When you initially set it up with j | ports 1 and 3 were used on the l I 

Currently SBC is sending another target from another switch on port 2, which we're not getting anything on. 


On the back of the l I cards that have 4 ports each, ie., x.l, x.2, x.3, and x.4. Port 1 of 

the first card is plugged into one of the two WIC DSU of router 100. Port 3 of the first card is plugged into one of the 



two WIC DSU of router 10 1. These appear to be working fine. 1 1 I 

| I mis takenly thought that for every different switch we were get ting the 9.6 ct)C fr om, we 

would need a separate router. l "p ointed out that it would only need a new port. SBC | I says all is 

functioning properly on their end for sending the CDC on the new target, on port 2. Port 2 is currently plugged into 
the other WIC DSU on router 100. Is there further configuration needed on our end for router 100, port 2 to collect 
the CDC? 


I tried plugging port 2 from thel In the new router you sent (routerlQ2), bu 

enlightenment you can provide will be greatly appreciated. | |92q 

t didn't collect anything. Any 


1 Thanks! 

b2 

UNCLASSIFIED 


b6 

b7C 

UNCLASSIFIED 


b7E 


UNCLASSIFIED 


[ 


From: 

Sent: 

To: 

Cc: 

Subject: 


](QTD) (FBI) 

| Friday. September 15. : 

UoTi 


](OTD) 


RE: Updated phone list 


AM 

(HO) (FBI)J_ 
' (FBI) 


(FBI) 


JHO) (FBI) 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


[ 


If we are going to do it after hours, how about if I come by on Tuesday 9-26 after I fly in? Just let me know what time would 
be best for me to get there, when we can turn it off and who to ask for? It shouldn't take very long, about 1 hour for the 
wiring. Then I will come back on Wednesday to complete the setup and testing. 

Thanks, 

[ ^ 2 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


CZl 

I will be at ERF the week of 25 Sep 06 but the BAE contractors anc j [ will be here. We are also putting in a 

new DCS 3000 in the plant next week (if it comes in) but I don’t think that will create any problems. 

As far as turning off the existing set up, it would be best to do it after hours to prevent agent hair fires. 

Give me a call if you have any questions - 713 


i nanKS, 

□ 


b6 

b7C 


0riginaU2essage^^____ <i __^ 

From: I |(OTD) (FBI) 

Sent: fridav. September L?>. 2L!TO~B :45 AM . . 

2; h =E=3 J (OT,>,FMl 1 t m)Wn 

Subject: RE: Updated phone list 

UNCLASSIFIED 

NON-RECORD 


b2 

b6 

b7C 

b7E 


□ 

I am done with the wiring and testing of the card cage and 1201 cards, I should be able to ship them out today. I 
have some person nal conflicts next week, so how does Wednesday 9-27 look for your schedule? My plans would 
be to fly out on Tuesday (afternoon sometime), see you on Wednesday morning, and fly back on Thursday (or 
Friday if we have issues). 


ALL INFORMATION CONTAINED 

HEREIN 15 UNCLASSIFIED 

DATE 06-13-2007 ET 6517 9BMD /KSR/HA J 



• • 

The existing setup will have to be turned off while I wire the new cage to the old one, I would estimate no longer 
than 1 hour. Let me know if that will need to be done after hours, or if its not going to be a problem to drop it during 
normal hours. 

Thanks. 


b6 

b7C 


b6 

b7C 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 

□ 

I will get to work on wiring the card cage, and testing. I should have that done next week (depending on how 
many interuptions I have). I will give you a call after I get them up and working to schedule a time to come 
down and install it. 


— Original mpc^hp — 

From: I t OTD) (FBI) 

Sent: Friday, September 08, 2006 9: 52 AM 

To: I ( FBI ) 

Cc: I 1 1 OTP) (FBI) 

Subject: RE: Updated phone list 


| Thanks. 


Original 

From: 

Sent: 

To: 

Subject: 


RE: Updated phone list 


>0) (FBI) 

HR. 201)6 5:35 PM 
JOTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


I just got back into town and spoke with l I the case agent on this matter. He advised that he 

would like to go up on the other number/s so we will be needing another card ca ge wired hit I should be 
in the office for the next couple of weeks if you need to reach me. My cell is 7 1 3 l D esk is 

713/6 1 I As far as I know the time frame is not critical but the case agents alway s would like the 

stuff to be up yesterday. Please let me know what your schedule looks like so I can tell | | what to 
expect. 


Thanks for your help. 

□ 


— Original 


To: 

Cc: 

Subject: 


RE: Updated phone list 


UNCLASSIFIED 

NON-RECORD 


You have 2 T-1 's going to the provider's site. It will handle a total of 24 lines, you should not have to 
order another T-1 at this time. You would just need to verify with the provider what channel the lines 


are on at the targets site and select that channel on the 1201 card. You have the capacity to intercept 
1 1 lines with the 1 201 cage that you have now. If you need to intercept more lines I will need to get 
another card cage wired up, and come down to connect the new cage with your existing one. 

Let me know if you want the additional card cage and 1201 cards to give you more than 1 1 channels, 
and the timeframe needed. 

Hopefully this helps, 

Thanks, 





From: 

Sent: 

To: 

j ItHOHFBI) 

■imk. August lfl. M(> 12:27 PM 
1 IfOTDHFBI) 


Cc: 


ZJHO) (FBI) 

Subject: 

RE: Updated phone list 


UNCLASSIFIED 

NON-RECORD 



l spoke with the case agent this morning re the other lines. He indicated that he will wait 
until he has the 1 1th line working and has spoken with the provider before ordering 
another T-1 for the other two lines. 


b6 

b7C 


Thanks for your assistance. Talk to you soon. 

I 1 

□(OTD) (FBI) 


— Original Nles 

From: 

Sent: 

To: 

Subject: 


Thursday. Ann list 17 7 006 9:11 AM 
|( H0 ) (FBI) 

1 tW: Updated phone list 


UNCLASSIFIED 

NON-RECORD 


Here is the last one that I can find, hopefully it will help. 

Did you get the 11th line working on the 1201's?? 

You said that they now have 13 target lines to intercept, if that's the case I will need to get the 
equipment together for that. I will need to come down and wire the new card cage to the 
existing one, similar to the other 1201's in the rack above this cage. Let me know if that's what 
you want and I will get started. 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 




Original Mes sage 

From: 1 l (OTDVCON) 

Sent: Thursday, June 29, 2006 3:03 PM 

To: ER-AII-Contractor-OTD- Employees; ER-AII-OTD-Employees 

Subject: Updated phone list 


If you are not on the list, or see someone’s name who is no longer here, please let me 
know. Thank you. 



UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 



bo 

b7C 


ItOTD) 


(FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 



] {HO) (FBI); 


UNCLASSIFIED 

NON-RECORD 


I have made my travel plans, let me know if they work for you. I will be arriving at IAH at 4:25pm on Sept. 26 after 
connecting through Charlotte, NC. I will head to the office after I get my bags, to wire the racks together and verify that 
they come back up. I will then return on Wed. Sept. 27 to complete and test. 

Let me know who to contact when I get there, since it will be after hours when I arrive. 

Hopefully that works for you guys, if not let me know and I can change my plans 




b6 

b7C 


— Original Message — 

From: I |(OTD) (FBI) 

Sent: 1 HMiW. LM r emBEr lb. 2UJb f ] :30AM 

To: I T Jwcn (ran i 

Cc: I T ore) (FBI) 

Subject: RE: Updated phone list 


}HO) (FBI) 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


If we are going to do it after hours, how about if I come by on Tuesday 9-26 after I fly in? Just let me know what time 
would be best for me to get there, when we can turn it off and who to ask for? It shouldn't take very long, about 1 hour 
for the wiring. Then I will come back on Wednesday to complete the setup and testing. 

Thanks — , 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD/KSR/MAJ 


I will be at ERF the week of 25 Sep 06 but the BAE contractors anq |vill be here. We are also putting 

in a new DCS 3000 in the plant next week (if it comes in) but I don’t think that will create any problems. 




b6 

b7C 


b6 

b7C 


As ’far as turning off the existing set up, it would be best to do it after hours to prevent agent hair fires. 
Give me a call if you have any questions - 713 - | | 


Thanks, 

1=1 

Original Message- — 

From: I I OTP I (FBI) 

Sent Wpmhpr 15, «- 4 s am 

To: I I OTP) (FBI); | | [HO) (FBI) 

Cc: | I otd) (flfl) 

Subject: RE: Updated phone list 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


I am done with the wiring and testing of the card cage and 1201 cards, I should be able to ship them out today. 
I have some personnal conflicts next week, so how does Wednesday 9-27 look for your schedule? My plans 
would be to fly out on Tuesday (afternoon sometime), see you on Wednesday morning, and fly back on 
Thursday (or Friday if we have issues). 

The existing setup will have to be turned off while I wire the new cage to the old one. I would estimate no 
longer than 1 hour. Let me know if that will need to be done after hours, or if its not going to be a problem to 
drop it during normal hours. 



UNCLASSIFIED 

NON-RECORD 


CZJ 

I will get to work on wiring the card cage, and testing. I should have that done next week (depending on 
how many interuptions I have). I will give you a call after I get them up and working to schedule a time to 
come down and install it. 

—Thanks— 


Original Mess age 

From: I I HOI (FBI) 

Sent: , Tuesday. Sfintember 05. zaqs 5:35 pm 

To: I 1 (OTD) (FBI) 

Subject: RE: Updated phone list 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


b6 

b7C 


' b6 
b7C 


. I just got back into town and spoke with I I the case agent on this matter. He advised that 

he would like to go up on the other number/s so we will be needing another card cage wire d up, I 
should be i n the office f or the next coupie of weeks if you need to reach me. My cell is 713 1 I 

desk is 713 1 I As far as I know the time frame is not critical but the case agents alway s would 

like the stuff to be up yesterday. Please let me know what your schedule looks like so I can tel l I 

what to expect. 

Thanks for your help. 

□ 


Original Meg agp 

From: I l (OTD1 (FBI) 


Sent: 

To: 

Cc: 

Subject: 


RE: Updated phone list 


8:31 AM 
|(HO) (FBI) 
l) (FBI) 


UNCLASSIFIED 

NON-RECORD 


You have 2 T-1‘s going to the provider's site, It will handle a total of 24 lines, you should not have 
to order another T-1 at this time. You would just need to verify with the provider what channel the 
lines are on at the targets site and select that channel on the 1201 card. You have the capacity to 
intercept 1 1 lines with the 1201 cage that you have now. If you need to intercept more lines I will 
need to get another card cage wired up, and come down to connect the new cage with your 
existing one. 

Let me know if you want the additional card cage and 1201 cards to give you more than 1 1 
channels, and the timeframe needed. 


Hopefully this helps, 
Thanks, 



b6 

b7C 


I spoke with the case agent this morning re the other lines. He indicated that he will wait 
until he has the 1 1th line working and has spoken with the provider before ordering 
another T-1 for the other two lines. 


Thanks for your assistance. Talk to you soon. 

[ 


Original 

From: 

Sent: 

To: 


Moc< f no 

I , kOTDI (FBI) 

J JbUtSdfl^»AUflUSL]i^006 9 : 1 1 AM 
I K UO) (FBI) 


Subject: 


FW: Updated phone list 


UNCLASSIFIED 

NON-RECORD 


Here is the last one that I can find, hopefully it will help. 

Did you get the 1 1th line working on the 1201’s?? 

You said that they now have 1 3 target lines to intercept, if that's the case I will need to get 
the equipment together for that. I will need to come down and wire the new card cage to 
the existing one, similar to the other 1201 's in the rack above this cage. Let me know if 
that's what you want and I will get started. 

I Thanks, | 


b6 

b7C 


— Original Mess age — 

From: I | OTD)(CON) 

Sent: Thursday, June 29, 2006 3 : 03 PM 

To: ER-AII-Contractor-OTD-Employees; ER-AII-OTD-Employees 

Subject: Updated phone list 


UNCLASSIFIED 

NON-RECORD 


If you are not on the list, or see someone’s name who is no longer here, please let 
me know. Thank you. 


{ 


b2 

b6 

b7C 

b7E 


Management AnaCyst 
Asset Management Vnit, <£<^ F 
(703 \ ~| 


UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 


UNCLASSIFIED 



UNCLASSIFIED 

UNCLASSIFIED 






From: I I OTP) (CON) 



Subject: FW: Immediate action required! 


Importance: High 

Follow Up Flag: Read 

Flag Status: Flagged 


UNCLASSIFIED 

NON-RECORD 


Please see j | e-mail below. Thanks. 



UNCLASSIFIED 

NON-RECORD 


ED 


please forward to the Unit. 


All, 


In an effort to answer a FOIA request, I am requesting that all TICTU employees and contractors immediately do a word 
search of their e-mail system (active and archived records) for the term "DCS-3000" and "DCS 30 00" and "D CS30Q0" 
(variations of the same term). If a document or e-mail is located print it and bring the hard copy to | jf or compilation. 

I need this accomplished ASAP. If there is a negative response - 1 need that also. 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD/KSR/MAJ 




Electronic Surveillance Technology Section 

Operational Technology Division 

ERF Qu anti co 

70 3 ~~T jesk 

20 3 t ell 


UNCLASSIFIED 


UNCLASSIFIED 



V 


From: 

Sent: 

To: 

Cc: 

Subject: 


l(OTDHFBI) 


DTD)(CON) 
L2D06 12:13 PM 

IfOTH'i IP RIV 1 


-if fOTDUCJ 




E 


J J T EE55S 

BUI 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


3otd) (FBI> I I 

^^],OTD,(CON, 1= | 

b6 

b7C 


b2 

b7E 

Hello all; 

Just a quick update on the I I status. 


• I reviewed the results of the link testing and in general they were better than I expected. Over the course 
of data collection, over 900 DCS events were captured with a capture rate of better than 99 percent. In 
addition, there were approximately 400 connections made with a better than 98% success rate. The 
missed connections appear to be in signal levels of less than -100 dBm. I’m still tabulating the data for 
the report but so far the link appears to be solid especially for signal levels about -100 dBm. 


• There was a meeting with security to discuss the VI deployment and as I understand it there were a 
number of questions that security requested to be answered. I believe the majority of those questions 
were with the DCS 3000 interface and security wish to ensure integrity of the DCS, even though the 
application is a single outward data stream through a VPN containing no evidentiary data. Hopefully 
there is no additional unforeseen work required based on the security meeting. 

• | fc t.al has continued to evolve features to the baseline we tested and I we will need a 

decision on which version to deploy. This is not critical this week but will become critical next week 
since we need to get the deployment packages ready. 

b6 

b 7 C • The major issue we currently have i s the lack of field evaluati on sup port. WFO picked up the 

application a week ago and assigne d | to the testing. l | oas out last week and talking 

with him today, he cannot support the effort until late next week. We were ready last week but 
without WFO support there was little we could do but continue the internal testing. If we are to 
wait on WFO then it puts us behind schedule by about two weeks. Unfortunately, without field 
testing we can not deploy per the test plan, WITT may have accept the results with the 
understanding that WFO was unable to support the effort and direct deployment without field 
testing. Not sure what we can do to get the WFO testing complete since we are dependent on WFO 
for the testing. Use of another office may be an option but we lose that one-on-one interface. 


If I have cap tured the status incorrectly please let me know. 

* b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 


ALL INFORMATION CONTAINED 

HEREIN 13 UNCLASSIFIED 

DATE 06-13-2007 BY 65179DMD/KSR/MAJ 


' Message 


From: |_ |OTD) (FBI) 

Sent: " Wednesday. August 1 of 2005 10:40 AM 

To: f ■TfO FriXFBir llQIQllCON) 

Cc: lofD) (FBI)] |oTD) (FBI) l | pTD) 

im 1 V 

Subject: RE: RMS Request #1 ] 

— r 1 

UNCLAS SIFIED \ 

NON-RECORD 

Please forward RMS request d | to I :OSO in i l unit. As I indicated to you in the previous e- 

mail, this is not e request for assistance to (conduct an electronic intercept. ATU/HAT's mission is to assist the 
field with high-capacity intercepts. 


In the event thai 

|Unit does r 

please immpdiafplv 
mission] 

jiqtify me and we (HAl 
phould at least see 1 


The EOSO Mission statement says: "To provide enhanced support for the testing, integration, operation, and 
availability management of [OTD] deployed technologies to ensure that field offices have the necessary physical 
infrastructure, technical resources, tools, operational guidance, and help desk to be successful in performing their 
Title III and Title 50 ELSUR missions." - OTD Web Site 


"I name from the RMS 


System. He | | a 


lOTD) (FBI) 
ausfm 2005 2:42 PM 
I (OTD) (FBI)J~ 


UNCLASSIFIED 

N ON -RECORD 


TICTU is handling another Service Request |_ 


I from Sacramento that reads, as follows: 


"Sacramento would like to request a DCS 3000 computer for our Modesto RA, so the RA will be able to 
use the tracker program. We also need a router for the Modesto RA, we will have the DCS use one 
channel of a Til that goes from the Modesto RA to the Sacramento office." 

| [ indicates that | ~~k hould be handled by your unit, with respect to the channel banks 

1 assistance. 
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DATE 06-13-2007 BY 65179DMD/K3R/MAJ 


10/4/2006 




RMO Program Manager 
ELSUR Technical Management Unit 



UNCLASSIFIED 

NON-RE CORD 


ATU/HAT received the above referenced request from Sacramento. This request is for assistance 
in setting up a telecommunications circuit (T-1), not for assistance in intercepting the circuit. 
ATU/HAT d oes intercepts. This should not have been directed to ATU/HAT. I believe this request 
should go tc| |Unit. Thanks. 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


10/4/2006 


' Message 


Page 1 of 2 


|(OTD) (FBI) 

From: I I OTP) (FBI) 

Sent: Tuesday, August 09, 2005 2:42 PM 


b6 

b7C 


To: 1 pTD) (FBI)l 

lOTD) (CON) 


Cc: 1 lOTD) (FB1);| 

|OTD) (FBI)I 

ZD(OTD) 

(TBT) ' 

Subject: RE: RMS Request #f 1 


b2 

UNCLASSIFIED 


b6 

NON-RECORD 


b7C 



b7E 

TICTU is handling another Service Request J |from Sacramento that reads, as follows: 



"Sacramento would like to request a DCS 3000 computer for our Modesto RA, so the RA will be able to use th e 
tracker program. We also need a router for the Modesto RA, we will have the DCS use one channel of 4 J ha 
goes from the Modesto RA to the Sacramento office." 


^indicates that | ~~j should be handled by your unit, with respect to the channel banks and T1 




F.F./CI.S 

b2 

RMO Program Manager 
ELSUR Technical Management Unit 

b6 

b7C 

Phone: (7031 

Cell- 1 

Fax: (703j 

□ 

n 



From! 

I'OTDI CFBI1 


Sent: Tuesday, August 09, 2005 1:51 PM 



30TD) (CO N)T kOTD ) (FBI) 

ToT D) (FBI)J I (OTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


b2 

b6 

b7C 

b7E 


ATU/HAT received the above referenced request from Sacramento, 
in setting up a telecommunications circuit (T-1), not for assistance in 
does interc epts. This should not have been directed to ATU/HAT. I 
| Unit. Thanks. 


This request is for assistance 
intercepting the circuit. ATU/HA T 
believe this request should go to | j 


UNCLASSIFIED 


b6 

b7C 


10/4/2006 
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10/4/2006 


OTD) (FBI) 

20, 2006 12:28 PM 
OTD) (FBI) 


OUDjeci: uoo oysicma ucpiuycu 

b6 

UNCLASSIFIED b7C 

NON-RECORD 


Hi | I 

The total number of DCS-3000, 5000, and 6000 systems deployed in the field is } | 

DCS3000 
DCS5000 
DCS6000 



b2 

b7E 


There are additional systems in repair/maintenance status as well as several in storage. Let me know if you need anything 
else. 


' AliiVageiftAnt 
Office: 703f" 
Cell: 

Fax: 


b2 

b6 

b7C 


U NCL ASSIF I ED 


ALL ILTF0PHATI0N CONTAINED 
HEREIN 13 DUG LAS SIFIED 
DATE 06-13-2007 BY 65179DHD/K3R/E 


From: | |OTD)(CON) on behalf o^_ 

Sent: Friday, October 14 2005 3:28 PM 

To: |OTD) (FBIv F 

Cc: | (OTD) (FBI) | 

PTD) (FBI) 

Subject: FW: TACC ' 


J(OTD) (FBI) b6 

b7C 


UNCL ASSIF IED 

NON-RECORD 


I checked with l I on this request. He 

are familiar with the folks making the request anq 


Subject: FW: TACC 


J(OTD) (FBI) 

14- 2005 2:47 PM 
_JOTD)(FBI) 


UNCLASSIFIED 
NON -REC ORD 


This request falls into ATU. Could you please contact |o provide assistance. 


From| 

Se nt; Thursday, 
To:| 


Subject: TACC 

UNCLASSiEIED 

NON^RECQRQ 


[NO) (FBI) 

diober 1J, 2005 10:31 AM 

□(OTD) (FBI) . 

1 tNO I (FBI)| 

-JnoJTfbdI 


K N O) (FBI)I 
JnO) (FBI)J 


_ [NO) (FBI); 

JNO) (FBI) 


(Shreveport and Monroe) have picked up handling all of ourl 


Jequirments (DCS 3000, Voice Box, etc). 


10/4/2006 


Message 


Page 2 of 2 


What I need up there now is a TACC for consensual phone calls. Our HQ city TACC was placed in storage (piled 
in with all other computers) when our bldg was emntied. Bef ore I submit an RMS, is it possible to get one sent to 
one of these RAs? We do have a full-time TTA | j assigned up there. 



UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


10/4/2006 


Message 


"loTD) (FBI) 


Page 1 of 2 


b6 

b7C 


From: | |(SecD)(CON) 

Sent: weqnesaay, May uJ~ 2006 3:26 P M 

To: I , Inmimm] 




" TTCTEHi 


_EiDrm 

ZZloimiFi 


as 


32 


''■JTDjJFBnt 


lilTD) (FBlJ" 


2 MEEHL 


(OTD) (FBI)|_ 


Subject: DOJ IRP EXERCISE 


-U MgAAOO i rt PP- 

non-record 




Tr^ri 


D) (FBl)L 
>TD)(CON)| 


HO 


;oti3) (FBI) 


b6 

b7C 


f~ |(CSO/OTD) provided a list that identified each of you as POCs for s everal svstg ms that need to 

bSTepresSTifSa in the Annual DOJ IRP Desktop Exercise. This list was provided by| |n response to an 

EC soliciting POCs for specified FBI systems. 

In order to comply with Federal Information System Management Act (FISMA) requirements, DOJ must test, at 
least annuall y, all component computer system Incident Response Plans (IRPs). This "test" or "Exercise" verifies 
that all components have (1) incident response plans (IRPs) , and (2) that components know where they are and- 
use them. The results of the desktop exercise reflect not only the components (FBI1 computer security posture, 
but also the Departments computer security posture. 


You were identified by your respective Division/Field Office CSO as the point of contact to participate in this years 
DOJ IRP desktop Exercise and you should have been contacted by your respective CSO regarding this as well as 
the systems you will be representing. This effort should take approximately 15-30 mi nutes of vour time to v ^ 

complete. Once completed, the required documentation will be e-mailed from you to | | for D ° 

compilation and dissemination to DOJ. Additionally, a Lessons Learned report will be required and must be b7 C 

received by May 10,2006. All required documents/templates are attached to this e-mail. 

Below are: (1) The section of the EC indicating the systems that need to be represented and (2) the instructions 
for participation in the desktop exercise. 

If any of the systems do not have an ATO or they are unknown, or you are not the appropriate POC, please 
indicate so in a response e-mail. Otherwise, please follow the instructions pertaining to the exercise and post- 
exercise. 


This exercise should take no longer than 15-30 minutes to complete. The exercise documentation is due to me 
NLT 12:00 noon. Tuesday. 10MAY2Q06: 


"Set Lead 25: (Action) 
OPERATIONAL TECHNOLOGY 


DATE: 06-13-2007 

CLASSIFIED BY 65179LMD/KSR/MAJ 

REASON: 1.4 (G) 

DECLASSIFY ON: 06-13-2032 


(3) 


AT Q UAN TICO. VA 

Provide the names and phone numbers of the designated representatives of "CART FQS," "CAR TS AN," "CEAU 
SCIF CPUs," "Centra Server/Symposium," "Cl NET," "CMPNET," "CSOC," "DCF SL| |DCS 3000," 

"DCS 5000," "DCS 6000," "DCS NET," "Demon," "Director Net," "EDMS," "ERFE," 'Vastmoney Vl/Squirmish," 


bl 




10/4/2006 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 


IS) 


Message 


OLbl\L I 


bl 


Page 2 of 2 


"FOISS," "J3094," "JDISS," "LV-NLMRS," "Omnilock 2000," "PSU-MMD, 


Dog," "Tael 
"TTAPNET, 


C jC " "TIPTI L^ i 


□ 


["RMS," "RPF Net," "Sheep 


frver," "TOU LAN," "TPDU ETL/CSL," "TPDU Internet LAN," "TRU(S)," "TRU(SBU)," 


"TWS," "WITT Ml 


(S) Exercise no later tnan April 14, 2006 to 


EX ERCISE INSTRUCTIONS : 


T Mf yn i antnng^ "\ A^^^PCCj ^a yH 'WMTS^whn ^ iii participatem t 


b6 

b7C 


1 . Review the scenario's (choose the scenario that best applies to your system(s)). (The questions accompanying 
the scenario's are just for you to consider when addressing the scenario - no response to the scenario questions 
is necessary). 


2. Review/refer to the Incident Response Plan (IRP) - SBU-Net and FBI-Net systems: Section 9.4 of your 
respective IRP; CJIS systems: appropriate Section(s) of your IRP. 


3. Fill-in the "Exercise Activity Log" - (the date and time will be the actual date and time you receive this e- 
mail. The first activity block is the scenario. Subsequent entries will address date/time and activities you 
performed when reacting to the scenario). 


4. Fill-in the "FBI Exercise Incident Report" - the date and time will be the actual date and time you receive this e- 
mail. Only fill-in as much information as you need to and are capable to. Not all blocks are expected to be filled- 
in, although they may if you know the information - it's up to you how much detail is provided.) 

5. All Exercise Responses (Incident Reports, Exercise Activity Logs) are due NO LATER THAN 12:00 Noon, 

Tuesda y, May 10, 2006 . 


1 . Review Lessons Learned material 


2. Complete Lessons Learned documentation 

3. E-mail Lessons Learned material to TCEARHART@fbinet.fbi no later than 12:00 noon. May 10 , 2006 . 

Please contact me via telephone with any questions that you may have, keeping in mind that I am one-deep and 
there are multiple participants. Please retain the IR P. This is a living documen t, so make any/all adjustments to it, 
turn "track changes" on, and send those changes te j | for configuration management of 

the master document. I will return the updated document to you with the changes. This should become a cyclic 
process as changes occur. 

b6 

b7C b6 

FBI ESOC-VIAC b7C 

202 1 1 


t tN QiA00ir 4ep 


10/4/2006 




I ~l0TD)(C0N) £ 6 

From: I I OTP) (CONI b7 ‘ 

Sent: Tuesday. Mav 30. 2006 4:34 PM 

To: | |OTD) (FBI) 

Subject: l iC'l u Monthly I raining Report 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


TICTU has two items for the Monthly Training Report | j sent you the total number of Bureau and 

Non-Bureau personnel that attended the conference in San Diego. Please include in item #2. Also, I'm sorry I didn't 
use the training form you provided but had difficulty submitting the text in the form. Thanks. 

(1) On 03/1-3/2006 TICTU personnel provided training for Tech Agents and financial support personnel in St. Louis 
Division on the Telecommunications Management Database (TMD). The TMD is a Web-based system to help the Field 
keep track of circuits, telecommunication intercept court orders, and the costs associated with the circuits and court 
orders. The system is accessible through Internet Explorer on a Trilogy desktop. At the 5 hour training held in St. Louis, 
there were 6 - 8 personnel in attendance 

(2) The TICTU conducted a two-day seminar on switch-based intercept concepts and methods in San Diego, California 
during 04/12-13/2006. The seminar was designed for Technically-Trained Agents (TTAs) and support personnel who 
routinely use collection equipment supported by TICTU. The seminar provided training on new DCS-3000 features and 
updates on many issues related to switch-based electronic surveillance. Additionally, the participants acquired a current 
overview of the Communications Assistance for Law Enforcement Act (CALEA) compliant solutions that 
telecommunication carriers use, and an updated description of the techniques developed by TICTU to provide intercept 
capabilities for these carriers' solutions. 


[ 


b6 
b7C 

UNCLASSIFIED 


OTD/F5T.VTT1 

703l 


ICT| 
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IOTP) (CON) 


From: 

Sent: 

To: 

Subject: 


L 


T[OTD) (CON) 
2006 2:46 PM 
:OTD) (FBI) 


TICTU Monthly training Report 


■bo ■ 

b7C 


bo 

UNCLASSIFIED b7C 

NON-RECORD 


TICTU has one item for the June Monthly Training Report. | lp rovided TPDU with the 

total number of Bureau and Non-personnel that attended the conference referenced below: 

The TICTU conducted a two-day seminar on switch-based intercept concepts and methods in Denver. Colorado 
on 06/06-07/2006. The seminar was designed for Technically-Trained Agents (TTAs) and support personnel who routinely 
use collection equipment supported by TICTU. The seminar provided training on new DCS-3000 features and updates on 
many issues related to switch-based electronic surveillance. Additionally, the participants acquired a current overview of 
the Communications Assistance for Law Enforcement Act (CALEA) compliant solutions that telecommunication carriers 
use, and an updated description of the techniques developed by TICTU to provide intercept capabilities for these carriers' 
solutions. 


0 1 1 3 / b!a I *=>/ 1 1L TD" 1 b6 

703 | | b7C 


UNCLASSIFIED 


ALL INFORMATION C OBTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179DHD/K3R/MAJ 



TICTU 


COLLECTION PROGRAM ACCOMPLISHMENTS 


DCS-5000 

The DCS-5000 program's primary objective for FY2006 was to provide continued support to 
ensure that foreign counterintelligence collection activities could be accomplished. A major 
accomplishment of the DCS-5000 project team included Certification and Accreditation (C&A) 
of the DCS-5000 in March 2006; security upgrades for all sites will be completed by 1 5 October 
2006. Additionally, in an effort to reduce personnel and maintenance costs, exploration of new 
operational and technical concepts of providing digital collection capability are being explored: 
(1 ) TICTU is pursuing a regional architecture and improvements to the current collection 
platform, and (2) implementation of a central domain server, web services server, and disaster 
recovery backup system. Additional accomplishments include: 

• Enhanced the ability to demodulate non-standard facsimile-deployed software enhancement 
to approximately 32 sites. 

• Worked with representatives from the Office of the General Counsel (OGC) on the Foreign 
Intelligence Surveillance Act (FISA) minimization procedures. 

• Installed nine systems and increased line input capacity of two systems. 

• Shipped and installed 70 workstations. 

• Provide training for approximately 60 Technical Agents (TAs)/Technically Trained Agents 
(TTAs) and Dedicated Contractor Support Personnel (DCSP). 

• Implemented remote maintenance capabilities. 

• Implemented Windows Workstations. 

• Implemented four major system software upgrades. 

• Number of sessions intercepted: 27,728,675. 


DCS-6000 


The DCS-6000 pr ogram started FY2006 with the process of upgrading systems to the 
current 3.6 release of the | | 

~| software. This was accomplished utilizing two different methods. Since many of the 
existing systems had reached the end of their lifecycle and were due for ha rdware repl acement 
new system hardware upgrades were performed which included the current I I so ft ware. 

The second situation involved performing software upgrades on existing systems. Both of these 


pg-i 
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situations required precise coordination and scheduling to accommodate field office operations 
and resources. 

The following numbers reflect the accomplishments during FY2006 in the DCS-6000 
program: 

• Twenty-three existing fixed-site systems were upgraded to rack-based systems. 

• Sixteen existing transportable systems were upgraded with new hardware. 

• More than 200 workstations were replaced with new hardware. 

• Numerous printers, jukeboxes, and CD/R systems were installed in field offices as 
replacement for existing devices or added to existing DCS-6000 systems to 
increase system capacity and collection ability. 

• In addition to the hardware upgrades, new DCS-6000 systems were deployed: six 
rack-based systems, one transportable system and eight offline analysis systems. 

Finally, in FY2006 the DCS-6000 program initiated the idea of reducing the burden and 
cost of deploying and maintaining over 100 systems by testing remote systems at sites (Resident 
Agencies) where these systems were setup for monitoring with the core system components. The 
system’s administrative duties were maintained at the main field office. As the program moves 
forward, the plan is to increase these types of deployments which would lessen the number of 
systems necessary in the field .while decreasing the associated administrative burden. 

INTERCEPT PROGRAM ACCOMPLISHMENTS 
Switch-Based Intercept Team (SBIT1 

• Coordinated and participated in two TICTU Regional Conferences. These conferences 
promoted discussions between representatives from all 56 FBI field offices and more than 
24 telecommunications carriers on operational issues related to CALEA. 

• Upgraded over 1 5 DCS-3000 server systems. 

• Implemented Continuity of Operations (COOP) procedures for both field offices and 
telecommunications carrier interconnection circuits. 

• Supported multiple field office requests for real-time Voice Over IP (VOIP) intercept and 
collection. 

• Upgraded and enhanced the DCSNET (the FBI’s CALEA data distribution network). 

• Provided equipment and expertise for the interception of all FBI CALEA-based criminal 
and FISA pen registers with more than 50 telecommunications service providers. 

• Developed and deployed the DCS-1020 gateway server for the real-time delivery of cell 
site location information to Wireless Tracking Team (WITT) vans. 

• Developed a computer based training course for DCS-3000 software suite to provide 
guidance and training to all FBI field offices on CALEA-based telephony surveillance 
(TESUR). 


pg-2 



High-Capacity Access Team (HAT) 

In the period of October 2005 through September 2006, HAT has handled over 85 requests 
from the field for assistance in counterterrorism, counterintelligence, and criminal cases 
including: 

• Forty-eight requests for assistance regarding the TActical Call Center (TACC) systems 
which provide the capability to record telephone conversations between cooperating 
witnesses and subjects they are calling through the TACC system. 

• Twenty-three requests for assistance regarding th<J Systems which ^2 

provide the capability to access Integrated Services Digital Network Primary Rate b 7 E 

(ISDN-PRI) signals. 

• Thirteen requests for assistance regarding a wide variety of other high-capacity protocols. 

In addition, we provided continuing support for a FBI Miami counterterrorism case which 
during this time period has intercepted in excess of 1,800 telephone calls. Intercepted 
communications and call data records provided by the system that HAT installed, operates, and 
maintains has allowed for the identification of a previously unknown terror organization and 
individuals operating in the United States. This information has supplied the probable cause for 
additional case and FISA initiations at other FBI divisions. The derived intelligence has been 
disseminated to the intelligence community, via approximately 50 IIRS, as well as to allies of the 
United States. 


Traditional Technologies 

• Received over 300 operational support and equipment requests through RMS. 

• Received over 1 000 telephonic requests for troubleshooting and field support. 

• Trained over 70 TTAs in Basic Telephony Intercepts. 

• Upgraded 62 J-3094 systems. 

• Coordinated a modification to the J-l 1 56 Remote Dialed Number Recorder (RDNR) for 
extended battery service. 

• Upgraded the Demon system in the Los Angeles, San Francisco, Honolulu, New York 
and Washington field offices. 

• Commenced the C&A process for the Demon System. 


P9-3 


DCS-5000, FISA Digital Collection systems are interconnected via a distributed, wide 
area network. In the event of a catastrophic failure at any given site, the DCS-5000 contractor is 
tasked to ship and install a replacement system to support the affected site. In the interim, 
collections can be accomplished for the affected site by re-routing TELCO lines and centrally 
collecting data in systems located within the ERF. The systems located within the ERF can 
collect up to 1 92 lines of input (as currently configured) for critical intercepts; overflow 
collections can be re-routed and collected at any of the other 75 collection systems located 
throughout the United States. The re-routing of collections to the ERF or other collection sites is 
intended to be a temporary solution until the DCS-5000 contractor ships and installs a 
replacement system to support the affected site. This was actually exercised during the 
September 1 1 when a temporary replacement system was deployed to New York until the field 
office was reoccupied and the primary system reactivated. It is noted the DCS-5000 program is 
currently in the planning stage of developing a regionalized distributed architecture where 
redundancy and backup will be incorporated. 

In the event of an emergency, criminal collection (DCS-6000) can also be diverted to 
another location in the affected area or city. From ERF, TICTU will be able to provide portable 
collection systems (six are currently on order) for audio collection or provide a rack system 
capable of handling over 1 00 lines of input. TICTU will also be able to depend on vendor 
assistance for a portable or rack replacement system, on-site and off-site installation and 
troubleshooting support, and additional workstations. 

The TICTU SBIT operations currently network all FBI Field offices with realtime 
delivery of pen register/trap trace information for all major wireless carriers. The continuity plan 
for these operations consists of redundant circuits and DCS 3000 server machines which reside in 
the FBI’s Salt Lake Field office. In case of a major catastrophe at ERF-E the Salt Lake 
computers and circuits would be configured to emulate the current operations. This 
implementation would require manual setup at this time from either Washington Field or the 
Richmond Field offices. TICTU has also implemented independent nodes into Resident 
Agencies for the major field offices to provide them with a continuity of operations (coop) site 
within their coverage areas. These offices are independent nodes on the DCSNET and have full 
access to ERF’s servers as the main field office. 



FY 2006 Intelligence Decision Unit Conferences 


Name of Conference 

Date(s) of 
Conference 

Purpose of 
Conference 

Location (Federal or 
Non Federal) 

Number of 
Attendees 
(FBI/Non-FBI 

Cost of 
Conference 

Conference 1 
TICTU Regional 
Conference San Diego 

04/12-13/2006 

To provide training to TTAs 
and support who routinely 
use collection equipment 
supported by TICTU. The 
conference will provide new 
DCS-3000 features and 
updates on many issues 
related to switch-based 
electronic surveillance. 

Non-Federal 
Doubletree Hotel-San 
Diego, CA 

Non FBI’ 
Vendors:! 1 

Contractors! 1 
Other LE :[ 1 

TR# 

Faci 

nz 

AV 

BAF 

1= 

1 

it^_Co^t : 

Costs: 1 1 

MaO- rials- 

Travel: 

Conference 2 
TICTU Regional 
Conference Denver 

06/07-08/2006 

To provide training to TTAs 
and support who routinely 
use collection equipment 
supported by TICTU. The 
conference will provide new 
DCS-3000 features and 
updates on many issues 
related to switch-based 
electronic surveillance. 

Non-Federal 
Adams Mark Hotel, 
Denver, CO 

FBH 1 

Non FBI: 

Vendorsf 1 

Contractors:! 1 
Other LE :| | 

TR# 

Con 

□= 

BAE 

itv Cost : 

Costs \ 
Materials: 

1 

1 Travel: 
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sites 

• provide net connectivity among all sites connected to 
the Trilogy network for the purpose of sharing 
information 

During the course of the Digital Collection-03 project, all 
objectives. were successfully met. Enhancements to initial 
capabilities for network connectivity, workflow management, 
reports generation, and ELSUR collections' transmission will 
continue to be refined. 


2.0 ARCHIVED PROJECT DOCUMENTATION 

(U) The Digital Collection-03 project was established in mid-year 
a consolidation of analogous TICTU project and activities. 

A Statement of Need was not prepared for the consolidated 
project. Actual completed products are reflected below. 


Document Title 

Author 

Document Date 

Statement of Need 

N/A 

N/A 

Project Plan ^6 

b7C 


August 31, 2001 
Proj Ldr Files 
PMO Files 
Bureau Files . 

Technical Requirement 
Specification 



Project Status Reports 

1 1 

Every 60 days/ 
PAMS 

Project Closeout Report 


r 

April 20, 2004 
Proj Ldr Files 
PMO Files 
Bureau Files 


3 . 0 PROJECT SUMMARY 

3.1 (S) MISSION NEED 

mi ^fc&dThe 9 oa l of Digital Collection-03 is to deploy automated 

systems that support the entire functional process of ELSUR 
evidence (Title III) and foreign counterintelligence (Title 50) 
collection, processing, report generation, and presentation. The 
project will improve the efficiency and productivity of case 
agents and translators, while also providing better evidence 
storage and communication capabilities. The Digital Collection 
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project will provide all-digital collection processing and 
storage capability, in which audio will be captured by digital 
collection systems, transcribed on these same systems, and stored 
on long-life digital optical media. 

3 . 2 X SYSTEM DESCRIPTION 

The systems being implemented in Project Digital Collection-03 
include DCS-6000, DCS-5000, and DCS-3000. The functional 
capabilities of each system are addressed in the following 
sections. 


3.2.1 (U) DCS-6000 

(U) Functional capabilities of this system include: 

• Audio Collection and Storage Subsystem (s) - Accepts 
inputs from various telephone and microphone sources, 
extracts Dialed Number Recorder (DNR) data, supports 
monitoring and minimization control, records audio and 
DNR evidence, supports playback for summarization and 
transcription 

• Evidence Archiving and Retrieval Subsystem - Accepts 
evidence media from the collection system for 
controlled storage. Provides indexing capabilities for 
later retrieval of specific evidence. 

(U) 3 -X DCS-5000 

(Uj Functional capabilities of this system include the following 

"20" areas : 

• Intercept input 
sources and media 

• Intercept signal 
types 

• Inter-system 
connection 

• Signal routing 

• Signal processing 

• Audio processing 

• Collection modes 

• Storage 

• Monitoring 


3.2.3 (U) DCS-3000 

U) Functional capabilities of this system include: 
• Initiates connection to TSP switches 


Audio Playback 
Word processing 
Display 
Printing 

File input/output 

Database 

Reports 

System setup and 
supervision 
Maintenance support 
Special workstations 
Other system capabilities 
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Matches incoming Call Data Content and Call Carrier 
Content 


• Stores and forwards capability for CALEA J-STD data 
(U) \ ^ 

3.3 OPERATIONS CONCEPT 

(U) Digital Collections systems are the FBI's primary vehicles 
for gathering digital information (voice-telephone service, 
facsimile, and microphone) for intelligence and criminal 
investigative purposes. Digital collection systems will be 
deployed in every field division and other locations as required 
by operational needs. 

[Uj ^ will be procured in three basic configurations: 

portable, transportable, and fixed. Portable systems are movable 
by two persons and designed for use in temporary situations; they 
do not require special power considerations. Transportable 
systems are more robust than portable systems and will be used at 
sites that anticipate ongoing or recurring operations that do not 
require a large number of inputs. Fixed systems will be 
installed at sites with known long-term requirements. Foreign 
Translation Centers, collection "hubs", or as required by 
operational needs . 

(U) Digital Collection systems are capable of standalone 
operations, but will normally be used within a networked 
environment. Both Title III and Title 50 systems will connect to 
the Trilogy, but not share information. Future considerations 
may require these systems to share information. 

(U) Digital Collections systems are used for the technical 
collection of electronic data which is processed and evaluated 
for migration to a separate information technology system where 
the collected data is analyzed, managed and archived as case 
related information. Processing of information collected through 
digital collection systems involves monitoring information, 
recording it onto digital media, and playback/transcription into 
a readable document. Collected information/data becomes 
"official record" material after it is transferred to case agents 
for analysis and management. 

3.4 (U) PROJECT ORGANIZATION 

(U) The Digital Collection-03 project team and supporting 
organization is depicted in the following figure. There were 
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3.6 (U) TECHNICAL PERFORMANCE 


(U) The Digital Collection-03 project was the culmination of 
TICTU’s effort to acquire a commercial-off-the-shelf (COTS) 
products to meet the FBI's needs for the digital collection of 
evidence and intelligence. 


ft. 0 * 


4.1 (U) DEPLOYMENT CHANGES 

(U) Based on operational requirements a decision was made by the 
Director to deploy a Title 50 collection system to every field 
division by the end of CY 2003. The cost and schedule impact 
resulted in the acceleration of deployments to specific, smaller 
offices and the delay of installations at New York and 
Washington . 

4.2 't&CT SYSTEM ENHANCEMENTS 


4.2.1 Work Flow Management. 


Implementation of a mechanism to monitor and provide reporting 
for audio sessions transferred, transcribed, and stored is being 
accomplished through a joint effort between Raytheon and the FBI. 
This effort will result in a Work Flow Manager ( WFM) system 
capable of providing critical management information to Language 
Services personnel and case managers throughout the FISA 
collection community. Software and hardware required to make 
this capability operational was completed in December 2003. 


(U) Stand alone equipment, which does not use system resources, 
was developed that provides for the transfer of audio sessions 
magneto optical (MO) to compact disc (CD) . This conversion 
equipment desi gnated as | | is planned for deployment at 

all sites with l 1 systems. Tne FBI plans to purchase this 

equipment for each fi eld office that has legacy media. Thirty- 
five (35) 1 1 Con verters have been installed to date 

including four Voice/Fax | {converters. 


(U)| |which permit legacy media to be read and converted 

using system resources, have been deployed to allow 15 offices 
read and convert their legacy media. 


5 . 0 PERFORMANCE 
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5.1 (U) COST PERFORMANCE 


Original Budgeted Cost: 

Total Budgeted Cost*: 

Actual Cost-at-Completion: 

Variance** ($) : 

Variance** (%) : 

*The Total Budgeted Cost reflects the contract baseline cost as 
revised by changes in system deployment requirements - schedule 
changes, system (s) reconfiguration, additional system deployment 

**Variances determined using the Total Budgeted Cost and Actual 
Cost-at-Completion 


5.2 (U) SCHEDULE PERFORMANCE 


1st 2nd 3rd 4th 1st 2nd 

Qtr Qtr Qtr Qtr Qtr Qtr 



6 . 0 LESSONS LEARNED 


1. (U) Key decisions (at HQ level) concerning acqui 
strategy delayed RFP and subsequent award. Timetab 
affected ability to conduct source selection evalua 
end of fiscal year and funds expiration. 

(U) Recommendation. Consider impact of external in 
procurement strategy and develop alternatives for s 
solutions (contracting, legal) . 
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TICTU's Submissions to tbe Director’s Report 
January - August 2006 

(U) January 2006: The DCS-3000 system was used in a case involving a drug-related 
kidnaping which took place in Asheville, North Caroline during 12/27/05. The Tracker programs 
were extremely helpful and well used since 2-3 agents/officers were working with the DCS-3000, 
trying to plot the locations of the numerous subjects, vehicles and residences involved in this 
case. This information was of great value in determining the whereabouts of the victim and the 
subjects prior to the series of arrests which ultimately took place. The victim was located 
unharmed. 

(U) January 24, 2006: TICTU personnel met with Section Chiefs and representative staff of 
Counterterrorism Division (CTD), Counterintelligence Division (CD) and Language Services 
Section (LSS) to discuss FY05 accomplishments, FY06 initiatives and future requirements for 
the Digital Collection System. Section Chiefs that were briefed included Margaret Gulotta 
(LSS), Michael Heimbach of the International Terrorism Operations Section (ITOS I), and 
John Kavanagh (ITOS II). All expressed their appreciation and considered the briefings 
extremely helpful. 

(U) February 3, 2006: The Security Division's Accreditation Unit, having conducted a review 
of the Certification Documents for the DCS-5000 in accordance with the requirements set forth 
by Bureau, Departmental, National policy, and the FBI Certification and Accreditation 
Handbook, granted the DCS-6000 system authority to operate (ATO) on the date noted supra. 

(U) February 21 - 24, 2006: TICTU personnel traveled to the DL office to assist with the 
conversion of thousands of old DMW archived audio sessions (FISA) to Windows-compatible 
audio files presentable for trial. This support was for the HOLY LAND FOUNDATION 
investigation. 

(U) March 2006: The Charleston West Virginia RA was extremely pleased with SBIT's 
tremendous efforts that led to the identification of a subject prior to the subject being able to 
carry out his threats, and who later confessed to making threatening calls. They may need 
additional help for the AUSA to show an interstate nexus. 

(U) March 6-8, 2006: TICTU personnel traveled to the NY office to retrain support personnel 
so that they will be able to aid case agents in the transfer of | b udio sessions (FISA) from 

the original archive MOs to standard Windows-compatible audio files presentable for trial. 

(U) March 1-3, 2006: TICTU personnel provided training for Tech Agents and financial 
support personnel in St. Louis Division on the Telecommunications Management Database 
(TMD). The TMD is a Web-based system to help the field keep track of circuits, 
telecommunication intercept court orders, and the costs associated with the circuits and court 
orders. The system is accessible through Internet Explorer on a Trilogy desktop. There were 6-8 
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personnel in attendance at this five hour training. 

(U) March - April 2006: Successful move from ERF to ERF-E of TICTU's administrative 
facilities and four laboratories (Traditional, Switch-Based Intercept, DCS 5000 and DCS 6000), 
as well as TICTU's approximately 35 personnel. TICTU became the first Unit to occupy 
ERF-E. 


(U) April 12-13, 2006: The TICTU conducted a two-day seminar on switch-based intercept 
concepts and methods in San Diego, California. The seminar was designed for Technically- 
Trained Agents (TTAs) and support personnel who routinely use collection equipment supported 
by TICTU. The seminar provided training on new DCS-3000 features and updated on many 
issues related to switch-based electronic surveillance. Additionally, the participants acquired a 
current overview of the Communications Assistance for Law Enforcement Act (CALEA) 
compliant solutions that telecommunications carriers use, and an updated description of the 
techniques developed by TICTU to provide intercept capabilities for these carriers' solutions. 

(U) May 22 - 25, 2006: TICTU personnel traveled to the DL office to help finalize conversion 
of thousands of old DMW archived audio sessions (FISA), and hundreds of old audio sessions 
stored on reel-to-reel tape, to Windows-compatible audio files presentable at trial. Also retrained 
ELSUR storage and support personnel in these processes. This support was for the HOLY 
LAND FOUNDATION investigation. 

(U) May 25, 2006: The Security Division's Accreditation Unit, having conducted a review of the 
Certification Documents for the DCS-6000 in accordance with the requirements set forth by 
Bureau, Departmental, National policy, and the FBI Certification and Accreditation Handbook, 
granted the DCS-6000 system authority to operate (ATO) on the date noted supra. 

(U) June 6-7, 2006: The TICTU conducted a two-day seminar on switch-based intercept 
concepts and methods in Denver, Colorado. The seminar was designed for Technically-Trained 
Agents (TTAs) and support personnel who routinely use collection equipment supported by 
TICTU. The seminar provided training on new DCS-3000 features and updates on many issues 
related to switch-based electronic surveillance. Additionally, the participants acquired a current 
overview of the Communications Assistance for Law Enforcement Act (CALEA) compliant 
solutions that telecommunication carriers use, and an updated description of the techniques 
developed by TICTU to provide intercept capabilities for these carriers solutions. 

(U) June 9, 2006: Two Customs and Border Protection Inspector arrested and charged with 
waving smugglers into the country in exchange for bribes. The two investigations involved six 
T-IIIs and 45 pen registers. 

(U) June 16, 2006: Twenty-two members of Mexican Mafia prison gang indicted for 
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racketeering. The Mexican Mafia investigation involved 12 T-IIIs and 39 pen registers. 

(U) June 20, 2006: Receive ^" fr n Global War on Terrorism (GWOT) supplemental 

funding from Finance Division to purchase Digital Collection System for GITMO. 


(I/) July 6, 2006: TICTU personnel provided training for Tech Agents and financial support 
personnel in New Orleans Division on the Telecommunications Management Database (TMD). 
The TMD is a Web-based system to help the field keep track of circuits, telecom munication 
.intercept court orders, smd the scats associated with Has, circuits and court orders. I ~| 

I | There were 6-8 personnel in 

attendance at this five hour training. 
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(U) July 27, 2006: TICTU personnel provided training for Tech Agents and financial support 
personnel in Indianapolis Division on the Telecommunications Management Database (TMD). 

The TMD is a Web-based system to help the field keep track of circuits, telecommunication b2 

intercept court ord ers, and the costs associated with the circ uits and court orders. The system is b 7 E 

accessible through [ I There were 6-8 personnel in 

attendance at this five hour training. 

(U) Aug ust 1, 2006: Phoenix Division conveyed to SBIT that their assistance in setting up the 
I b ens with cell site location worked and the murder-fugitive was arrested yesterday 

morning in a remote construction site well to the west of Phoenix. Through DCS surv eillance 
and mapping, the Fugitive TF was able to narrow the location. They also i mported th e | 1 
sites from SBIT's DCS Web site and imported it into Streets/Maps program. ! j assisted with ^2 
a final "ping" when they were in range. Arrest was made, no shots fired. 

b / E 

(U) August 1-7 7006: TTUTTI met with m^mhpp 0 f the DEA's Subpoena Intelligence Center 
Staff and I i n New York regarding electronic formatting to 

examine possible strategies for speeding up/streamlining processing of phone records within the 
Bureau. 

(U) August 21, 2006: The recent DCS-3000 solution SBIT provided to New York allowing 
them to get pen data to their Chelsea location and into the VoiceBox system was invaluable. 

Instead of providing pen data for what was expected to be a short period of a few days, it 
continued to provide data to their Title Ills for two weeks. The restore process failed when 
attempting to import data from the old version at Chelsea into the new version at the CMP. The 
problem was solved last week, but SBIT's equipment allowed NY to have a manageable problem 
instead of a major headache. 
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LAW ENFORCEMENT SERVICES BRANCH 
WEEKLY BRIEFING TO EAD ASHLEY’S OFFICE 

DIVISION/OFFICE: OTD/TICTU WEEK: 09/05/2005 


EXISTING ISSUES/INITIATIVES 

Issues/Initiative: 

For the Telecommunications Intercept and Collection Technology Unit to increase Voice-Over-Intemet Protocol 
(VoIP) intercept accomplishments. 

Division's Response: 

TICTU has aided the Oklahoma City Division in finally collecting on a| | 

after much effort over the last few months. 

b2 

Significant Developments: b 7 E 

TICTU modified the DCS-3000 system used for| |to accommodate the VoIP audio 

format delivered by| |[ 

The solution offered b'j b is less than perfect and took more than 90 days 

(the period of the first order) for| |to implement. However, TICTU was able to guidtj |toward a 

fundamental (voice and pen-register) intercept capability that is not standard but is functional, and so tar the 
Oklahoma City Division is satisfied with the result. 

NEW ISSUES/INITIATIVES 

Issue/Initiative: 

Division's Plan: 

ADMINISTRATIVE/FINANCE MATTERS 

Issue: 

Division's Response: 

- - - ft t t T?.nrnm^77n]if CQHTAIHEI* 

Next Steps- herein is unclassified 

P ■ DATE 06-14-2007 BY 65179DHH/KSR/EAJ 


Please indicate with an ('*") if the issue/initiative should be raised to Director Mueller's attention. 



LAW ENFORCEMENT SERVICES BRANCH 
WEEKLY BRIEFING TO EAD ASHLEY'S OFFICE 

DIVISION/OFFICE: OTD/TICTU WEEK: 06/06/2005 


EXISTING ISSUES/INITIATIVES 
Issues/Initiative: 


Division's Response: 


Significant Developments: 


Current Status: 


NEW ISSUES/INITIATIVES 

Issue/Initiative: 

To expand the intercept capabilities of the Telecommunications Intercept and Collection Technology Unit 
(TICTU). b2 

b7E 

Division's Plan: 

The Operati onal Technology Division’s (OTP) TICTU has recently facilitated realti me audio and pen-register 
intercept forj |TICTU designed and 

developed a new intercept and delivery capability, using the DCS-JUUU system, to perform intercepts for the 
Buffalo, New York and New York City Field O ffices. The TICT U's infrastructure was instrumental in providing 
the conduit for this information to flow from the ) | delivery points to the offices performing the 

surveillance. These new services provide constant challenges to current Electronic Surveillance (ELSUR) 
collections. The realtime flow of this information will allow agents to immediately act on information if 
necessary. Also. TTCTIJ recently assistejl the New York City office with a pen-register intercept of a 


ADMINISTRATIVE/FINANCE MATTERS 

Issue: 


Division's Response: 


Next Steps: 


Please indicate with an if the issue/initiative should be raised to Director Mueller's attention. 


• • 

LAW ENFORCEMENT SERVICES BRANCH 
WEEKLY BRIEFING TO EAD ASHLEY'S OFFICE 

DIVISION/OFFICE: ITD/TICTU WEEK: 10/18/2004 

EXISTING ISSUES/INITIATIVES 

Issues/Initiative: 

To gain authorization from the FBI's Security Division to implement a new cellular target location tool that will 
aid the FBI in field and surveillance initiatives. 

Division’s Response: 

The Switch-Based Intercept Team (SBIT) within the Investigative Technology Division/Telecommunications 
Intercept and Collection Technology Unit (TICTU) is working with the Security Division to gain authorization 
to egress cell site Global Positioning System (GPS) coordinates to mobile FBI agents. This is accomplished by 
pushing a target’s wireless cell site location information, obtained via a CALEA Pen Register with location 
authorization, out to the field and/or surveillance agent identifying the target's cell site in use. 

Significant Developments: 

The SBIT has developed tracking software and complied a cell site database to provide the geographic location 
of a particular target's location per CALEA event messages. The DCS-3000 software has been enhanced to push 
cell site GPS coordinates for specific targets to a remote tracking laptop of mobile FBI agents. The SBIT has 
been informed by FBI field offices that cellular tracking in formation has successfully aided the | | 

* ' — ^ b2 

Current Status: 

This FBI DCS-3000 enhancement has been prototyped and is ready for implementation, pending authorization 
by the FBI's Security Division, and will aid FBI field and surveillance agents in target location. 

NEW ISSUES/INITIATIVES 
Issue/Initiative: 


Division's Plan: 


ADMINISTRATIVE/FINANCE MATTERS 

Issue: 


Division's Response: 
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Director's Monthly Report Submission for June 2004: 


INVESTIGATIVE TECHNOLOGY DIVISION/ELECTRONIC 
SURVEILLANCE TECHNOLOGY SECTION/TELECOMMUNICATIONS 
INTERCEPT AND COLLECTION TECHNOLOGY UNIT 
(ITD/ESTS/TICTU) 

1) The Telecommunications Intercept and Collections Technology Unit (TICTU) Switch-Based 

Intercept Team (SBIT) recently provided the Data Interc ept and Technology Unit (DITU) with a 
new capability for performing the FBI’s first | [ tireless internet intercept. The SBIT 

team developed a secure delivery method for intercepted wireless Internet sessions. | ] 

with lawful authorization, can now deliver a subscriber's web-based activity to DITU using 
equipment provided by SBIT. 

2) The SBIT has also successfully comp leted the development of an interc ept canabilitv for 

| (service. SBIT closely worked with | | to 

develop access, delivery, and collection capabilities for this service over the last three months. 
SBIT designed and developed the new solution using the DCS-3000 platform. The enhanced 
DCS-3000 will directly interface with other FBI collection systems to provide the field with a 
fully integrated collection capability for both criminal and national security investigations. SBIT 
has shared the new capability with the | l and plans to make the solution available to all law 
enforcement agencies that require assistance. 
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FEDERAL BUREAU OF INVESTIGATION 


10/02/2006 

Jqt-erf 





loav Section/' 

H I 


Precedence: ROUTINE 

To: Finance 

Criminal Investigative 

IT Operations 

From: Operational Technology 

Electron ic Surveillance Techn olo gy Section /TICTU/OT-ERF 

Contact: £ [703-' 

Approved By 

Drafted By: 

Case ID #: 269-HQ-1436080 

Title: DIGITAL COLLECTION SYSTEMS NETWORK 

Synopsis: Finance Division is requested to provid e funding for 

the Digit al Collection Systems N etwork (DCSNET) to| j 

| | under the GSA | | contract . 


b6 

b7C 


b6 

b7C 


Enclosure (s) : FD-369, Q 


] in the amount of Q 


b2 

b7E 


Details: The Telecommunications Intercept and Collection 

Technology Unit (TICTU) is responsible for the development, 
deployment, and support of access and collection technology to 
perform lawfully authorized electronic surveillance (ELSUR) of 
telecommunications services. 

The DCS-3000 and DCS-5000 systems provide access and 
collection of both call detail information (i.e., pen-register 
and trap/trace) and call content for a variety of 
telecommunications switches. To deliver the ELSUR data from the 
service providers to the collection systems require a reliable, 
scalable network. The DCSNET provides this connectivity. The 
local service available under the WITS contract will allow for 
DCS-3000 and DCS-5000 development, testing, and operations under 
exigent circumstances. 
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To: Finance From: Operational Technology 

Re: 269-HQ-14 36080 , 10/02/2006 


Finance Division is requested to provide fnnriinn for 
the Digit al Collection Systems Network (DCSNET) to | I 


funder the GSa[ a 

rrom budget Item IC, Sub-object Classification] 




.vailable 



To: 

Re: 


Finance From: Operational Technology 

269-HQ-1436080, 10/02/2006 


LEAD (s) : 

Set Lead 1: (Action) 


FINANCE 

AT WASHINGTON, DC 

The Finance Division is requested to take steps, on the 
behalf of TICTU, to enter into a procurement for a network that 
will support the operation and maintenance of ELSUR systems for 
emerging wireless and wineJJja£_Jielecommunications technologies. 
Funding in the amount of I . li-s avaiiahip from Budget Item 
IC, Sub-object Classification ! | 

Finance Division is requested to process this 
procurement request and notify OTD of its receipt and completion. 

Set Lead 2: (Info) 


CRIMINAL INVESTIGATIVE 
AT WASHINGTON. DC 
For information only. 

Set Lead 3: (Info) 

IT OPERATIONS 


CC: 


♦♦ 


For information only. 


1 QT-ERF 
JQT -ERF 

QT-ERF 
QT-ERF 

■Qt-erf 

QT-ERF 
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Precedence: ROUTINE 

To: Finance 

Counterintelligence 

IT Operations 


Date: 09/07/2006 



Rm 6421 (Enc) 
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From: Operational Technology 

Electronic Surveillance Technol 

Contact: 


Approved By: 


Drafted By 
Case ID # : 


Jbic 


ogy Se. 
1 703 { 


ctinn/TTCTU/OT-ERF 
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Title: DIGITAL COLLECTION SYSTEMS NETWORK {DCSNET) 


Synopsis: The Finance Division iff rpuncfit.fifi t~,n nrnYirifi cunti nup.d 

funding for the DCSNET to 1 \ 

I I under the GSAl I contract . 

Enclosure (s) : FD-369, I I in the amount of | "| 


Details: The Telecommunications Intercept and Collection 

Technology Unit {TICTU} is responsible for the development, 
deployment, and support of access and collection technology to 
perform lawfully authorized electronic surveillance (ELSUR) of 
telecommunications services. 

The DCS-3000 and DCS-5000 systems provide access and 
collection of both call detail information (i.e., pen-register 
and trap/trace) and call content for a variety of 
telecommunication switches. To deliver the electronic 
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Finance From: Operational Technology 

2 69-HQ-14 36080, 09/07/2006 


To : 
Re: 


surveillance (ELSUR) data from the service providers to the 
collection systems requires a reliable, scalable network. The 
DC.SNFT prov ides this connectivity. The TICTU requests that 

| be allocated to the DCSNET . 

The Finance Division is requested to take steps, on the 
behalf of TICTU, to enter into a procurement for a network that 
will support the operation and maintenance of ELSUR systems for 
emerging wireless and wi reline telec ommunications technologies. 
Funding in the amount of ! lis ava ilable from Budget 

Item IC, Subobject Classification | | 
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"To: Finance From: Operational Technology 

Re: 269-HQ-1436080, 09/07/2006 


Set Lead 1 : (Action) 


AT WASHINGTON. DC 

The Finance Division is requested to take steps, on the 
behalf of TICTU, to enter into a procurement for a network that 
will support the operation and maintenance of ELSUR systems for 
emerging wireless and wi -i ne» tpl pmmmiini rai-i nnc technologies. 
Funding in the amount of | I is ava ilable from Budget 

Item IC, Subobject Classification ] | 

Set Lead 2: (Info) b2 

b7E 

COUNTERINTELLIGENCE 

AT WASHINGTON. DC 
For information only. 

Set Lead 3: (Info) 

IT OPERATIONS 


AT WASHINGTON. DC 


For information only. 

I QT-ERF (Enc) 
I QT-ERF (Enc) 
~J QT-ERF (Enc) 

T ot-erf (Enc) 

I QT-ERF (Enc) 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 11/18/2005 


Criminal Investigative 
IT Operations 

From: Operational Technology 

Electron ic Surveillance Technolo gy Se 

Contact: | ~| 703-[ 

Approved By: 


| Rm 6875 

6875 

, I Rm 5155 (Enc) 
1 Rm 6421 (Enc) 



Drafted By: | | bic 

Case ID #: 269-HQ-1436080 

Title: DIGITAL COLLECTION SYSTEMS NETWORK ( DCSNET) 

Synopsis: The Finance DijtLaiaa is rp.anestfiri t.n nru\ 

_ funding ^ or the DCSNET to| 
f I contract. 1 


iide continued 
|under the GSA 


Enclosure (s) : 


in the amount of 


Details: The Telecommunications Intercept and Collection 

Technology Unit (TICTU) is responsible for the development, 
deployment, and support of access and collection technology to 
perform lawfully authorized electronic surveillance (ELSUR) of 
telecommunications services. 

The DCS-3000 and DCS-5000 systems provide access and 
collection of both call detail information (i.e., pen-register 
and trap/trace) and call content for a variety of 
telecommunications switches. To deliver the ELSUR data from the 
service providers to the collection systems requires a reliable, 
scalable network. The DCSNET provides this connectivity. 


ALL INFOPIIATIOM CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-14-2007 BY 65179DMH/KSR/MAJ 



To: Finance From: Operational Technology 

Re: 269-HQ-1436080, 11/18/2005 


The TICTU requests that[ 
from Budget Item JM 


|be allocate d to DCSNET 
Subobject Classification I I 
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To: Finance From: Operational Technology 

Re: 269-HQ-1436080, 11/18/2005 


LEAD ( s ) : 

Set Lead 1 : (Action) 


FINANCE 

AT WASHINGTON, DC 

The Finance Division is requested to take steps, on the 
behalf of TICTU, to enter into a procurement for a network that 
will support the operation and maintenance of ELSUR systems for 
emerging wireless and wj r^i ine tel ecommuni cations technologies. 
Funding in the amount of I l i a i J e from Budget 

Item JM, Subobject Classification ! | 

Set Lead 2: (Info) 

CRIMINAL INVESTIGATIVE 
AT WASHINGTON. DC 
For information only. 

Set Lead 3: (Info) 

IT OPERATIONS 
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AT WASHINGTON. DC 


CC: 


For information only. 

I 1 O T-ERF (Enc) 

1 I OT -ERF (Enc) 

I I QT-ERF (Enc) 

| QT-ERF (Enc) 
QT-ERF (Enc) 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/12/2006 


To: Finance 

Attn: 

1 ERF 



| FMU, Bldg 15 

Counterintelligence 

Attn: 

1 


Rm 5270 


From: Operational Technology 

Electron ic Surveillance Technolo gy fiRct i on /TTCTU/OT-ERF 

Contact 03^ | 

Approved By: 


Drafted By: 


Case ID #: 268-HQ-1045581 


Tbic 


Title: DCS-3000 

Synopsis: The Engineering Contracts Unit (ECUT is reques ting to 

exercise the second option year with | | to 

provide labor and services to continue to support the 
specification, development, verification, operation and 
maintenance of electronic surveillance systems for emerging 
wireless and wireline telecommunications technologies. 

Enclosure (s) : FD-369 f | in the amount of | | 

Details: The Telecommunications Intercept and Collection 

Technology Unit (TICTU) is responsible for the development, 
deployment, and support of access and collection technologies to 
perform lawfully authorized electronic surveillance of 
telecommunications services. The TICTU is engaged in a number of 
rapidly developing and changing telecommunications activities and 
projects that require development, program planning, requirements 
development, deployment, support of collection systems, and 
industry liaison and coordination support. In order to 
accomplish its mission, the TICTU requires the augmentation of 
its current capabilities with additional collection system 


b2 

b7E 


b6 

b7C 


b2 

b7E 


ALL INFORMATION CONTAINED 

HEREIN 13 UNCLASSIFIED 

DATE 06-14-2007 BY 6 5 1 7 9DMH/ KSR/HA J 




To: Finance 

Re: 2 68 -HQ- 104 5581 


From: Operational Technology 


software development, wireless communications technical 
expertise, and telecommunications industry expertise. 


The DCS-3000 system is a custom system developed, 
deployed, and supported by the TICTU. The DCS-3000 provides 
access and collection of both call detail information 


(i.e., pen-register and trap/trace) and call content for a 
variety of telecommunications switches. The DCS-3000 has 
recently been modified to comply with new Counterintelligence 
Division (CD) security requirements to meet certification and 
accreditation. These modification are integral to maintaining 
security and timely pen register and voice collections. New 
technologies that must be addressed include Voice Over Internet 


Protocol, packet-mode telephony. General Packet 



TICTU 's activities | 

qualif ications raqui rpri t-n 

depth of the TICTU program needs. I 

the development of the current PCS-iMu c 

recently ! 

suite to accommodate one way push scenari 


qq fhp nr^-irft-n anri 

I supported 
lec tion system. Most 
^jDCS-3000 software 
To enable Title 50 


systems to accept Communications Assistance for Law Enforcement 
Act (CALEA) data into Foreign Tntel 1 i pence Surveillance Act 
Collection (FISA) systems. | (also has 
technical expertise in the riSld <51 6EI-S11? filfiitronic 
surveillance of wireless communications systems. 


b2 

b7E 





To: Finance From: Operational Technology 

Re: 268-HQ-1045581 


LEAD (s) : 

Set Lead 1: (Action) 

FINANCE 

AT WASHINGTON. DC 


The F.CU is rfimiest ed to exercise the second 
option year with j . I Funding is available from 

Sub-object Cl assification ! | Budaet Tfem .tm in the amount of 

I Suh-nhSeni- Classification I l Budg et Item JM in 

the amount of 1 I and Snh- nhi set r.l assi cati on | | 

Budget Item IC in the amount of | | 

Finance Division is requested to process this 
procurement request and notify OTD of its receipt and completion. 

Set Lead 2: (Action) 


COUNTERINTELLIGENCE 

AT WASHINGTON. 


-DC 


Approve fund ing to exercise the second option 
year with j~~ I Funding is available from Sub- 

ohiect Classif ication ! | Budget It em JM in the amount of 

| j Sub-obje ct Classification ! j Budq et Item J M in 

the amount of * I and Sub-olj,'"*' " - Aj .. i l 

Budget Item IC in the amount of | 

CC: 


sifi 






J QT-ERF 
J-ERF 
J QT-ERF 
r-mp 


jT7f-ERF 


b6 

b7C 


b2 

b7E 


b2 

b7E 


b2 

b7E 


3 


[ 


] 




IOTP) (FBI) 


From: 

Sent: 


b6 

b7C 


Subject: 

Importance: 


Follow Up Flag: 
Flag Status: 


□OTD) (CON) 


Wednesday .Oc tober 04, 2 006 12:11 P M 

' JLQim (EBM 




<CON)l 








~|['mni (FRivI 


-mmEm 


p 


~lfOTDKCON)T 


Thu 


t OTD) 

rOTD) (CON); 


3sm m 


I(Qtd) ZEEEL 






lOTDrilm 

(otd) Mm. 


[O TD) (FBI); I" 


I (O TD) (CON): 
l(OTD)(CON):| 






iE 


I (OTD) f FBI >1 


'W; [ 


1(<?TP) (FBI) J 


j(0'iDnno)j t ,^px] 


FW: Immediate acti o 
High 


Read 

Flagged 


Ttttdtttw 


]mwmc 


JOTD) 


UNCLASSIFIED 

NON-RECORD 


Please see | l e-mail below. Thanks. 

i i 


703|_ 


1 


Original Mess age — 

From: I I (OTD) (FBI) 

Sent: Wgrinpsriav Orfnhpr 04, 2006 1 1 :02 AM 

To: | l OTD) (CON) 

Subject: immediate action required ! 

Importance: High 

UNCLASSIFIED 

NON-RECORD 


please f orward to the Uni t. 


Ah, 


b6 

b7C 


b6 

b7C 


In an effort to answ er a FOIA request, I am requesti ng that al 1 TICTU employees and contractors i mmediatel y do a word 
search of their e-mail system (active and archi ved records) f or the term 'DCS -3000'' and "DCS TOOO” and "DCS 3000" 
(variations of the sam e term ). Ifa docum ent or e-m ail is located pri nt it and bring the hard copy to{ Ifor compilation. 


I need thi s accom plished A SAP. Ifthere is a negati ve response - 1 need that al 



Thanks 


□ 

5Sa \~ I 

Chief, Telecommunications Intercept & Collection Technology Unit 
Electronic Surveillance Technology Section 
Operational Technology Division 
ERF Q^nU^— 

70 J t esk 

20 3 "I cell 


UNCLASSIFIED 


UNCLASSIFIED 


b6 

b7C 




SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 

J(OTD) (FBI) 

From: | | (U) (FBI) 

Sent: Tuesday I Wwn her Ilh.'j inOS 9: 17 A M 

To: I |(OTD) (FBI) b6 

Subject: Kt: b7C 


UNCLASSIFIED 

NON-RECORD 



UNCLASSIFIED 

NON-RECORD 


□ 

Forgot to include y ou, so sorry . FYI. Let’s see if anything transpires f rom this. 



b7E 

Guys, 

The q uestion continues to pop-up, how does the f ield handle FISA inf ormation; classif ied. or 
unclassif ied? Can w e dev elop a proc edure re g arding the proper handling and transf er of data thru 
the DCS-3000 One W ay Push into tb j \ Or use an alternate approach? 

B mentioned the possibility of using ! | for each reg ion and au tom ajically download the | “j 
This may be a v iable option? More details w ill be need f or a discussion. 

Other sug gestions? Any way to provide the f ield with an answ er? 


Thnx, 


-c 


ALL INFORMATION CONTAINED 

HEREIN 13 UNCLASSIFIED 

DATE 06-14-2001 BY 6 5 17 9DMH/KSR/HAJ 


From: | p TD) (FBI) 

Sent: wennesnav imv ui .TO4 4:28 P M 

To: I I f IIP) (FBI) 

Subject: FW : FISA Pen Regi ster Data 


Pen register data 
for FISA rel... 


El 0 B 


t!T[ 


Discussion with RE: Discussion with 

I LI I 



UNCLASSIFIED 

NON-RECORD 



SENSITIVE BUT 


b6 

b7C 


Forgot to include y ou, so sorry . FYI. Let's see if anything transpires f rom this. 


Thnx, 


— original Message — , 

From ! | (ITD) (FBI) 

Se nt: Wednesday. Ju ly 07. 2004 . 1 dd AM 
i (ITD) (FBI)| 

C d I (ITD) (FBI) 

Subject: FW: FISA Pen Register Data 


] (ITD) (FBI), [ 


JlTD) (FBI); | I lTD) 

b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Guys, 


The question continues to pop-up, how does the f ield handle FISA inf ormation; classif ied. or 
unclassif ied? Can w e dev elop a procedure reg arding the proper handling and transf er of data thru 
the DCS-3000 One W ay Push into the 3094? Or use an alternate approach? 


[mentioned the possibility of using EDMS for each reg ion and autom ajicaily download the T el 
Apps. This may be a v iable option? More details w ill be need f or a discussion. 


Other sug gestions? Any way to provide the f ield with an answ er? 


b6 

Thnx, b7c 


ALL INFORMATION 1 CONTAINED 

HEREIN 13 UNCLASSIFIED 

DATE 06-14-2007 BY 65179DHH/K3R/N 



Original Message- — 

FromJ 1 (ITD) (FBI) 

Se nt: Thursday. Mav ‘ 17 . 2fl04 2:35 PM 

To} I (ITD) (FBI)J KITD) (FBI) 

SuDjecE 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


A) (FBI) 

05 9:17 AM 
)TD) (FBI) 


From: 

Sent: 

To: 

Subject: 



UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


So far we have not had the stack problem We did however have that problem with our other connection to the DCS 3000 
on the 16th floor. I talked t d b bout it and he had missed that machine. He has installed the patch on the 

DCS 3000 on the 16th floor and It appears that it is working. We will continue to monitor everything and if the error 
appears again we will immediately contact you. 


ttaF 



TBC 


|OTD) (FBI) 
2EjflQ5 4:49 AM 


1005 4:4? 

Jap (fbi); FZ 

JAT) (corq_ 


JSELCraQi, 


J(la) (ra!T" 


3 d ) (FBI)C 


J(IP) 


UNCLASSIFIED 

NON-RECO RD 


Good Morning - Wanted to check with you to see how the DCS 3000 patch w as working with the J-3094. A re you still 
getting the out of stack errors or locking up? T hank s for the info... bd 


UNCLASSIFIED 


UNCLASSIFIED 




The Dialed Number Recorders are the equipment that decodes the dialed information along with a date/time stamp 
her misc call information. They pass that information to the J-3094 which stores it. There are options where the user 


can input target name but not the case number. The is another module which almost no one uses which allows the user to 


input or import more detailed target information. This module is not required by the system and can be removed in needed. 


in a majority 0 f FO's the DCS 3000 is connected to the system. Specific connection details should be addressed t 
| | (ERF) 


€Z2 



SENSITIVE BUT UNCLASSIFIED 


I have a m eeti ng witt] |at 1 lam this morning to discuss som e speci he situations w here rul ings need to 

be made on cl assi fieation. before t go I want to make sure that I descri be your situation accuratel y. 

The J3094 S ystem collects si gnal tones, conv erts the tones i nto the num eric representati on, and stores that 
information as the P en Regi ster data f or the targeted 1 ine. No voice is collected. T he appl ication user has the 
capabi lity, and often uses the capabi lity, to enter case IDs or other case rel ated i nformation and associ ate that 
information with the P en Regi ster data. T he information is then copi ed onto a di sk to be upl oaded i nto the T elephone 
Application. 


If there is a plan to connect thi s to the DCS 3000 or DCS 5000, please 1 et me know how that connecti on will be 
established. I recal 1 seei ng som e com ment on the use of theCI-100. 


b6 

b7C 




SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 





| |(OTD) (FBI) 

F rom: I I (OTD) (FBI) 

Sent: Tuesday . June 20. 200 6 7:46 A M 

To: | VS F) (FBI) 

Subject: ' Kb TO Number " ? en r 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


Good morning, The 800 number intercept depends on the company that provides it. I will try to find out some more info 
from the DCS 3000 guys and see if they have done one. The equipment can be shipped back here for repair or 
replacement, bd 


Message — 


lSF) (FBI) 
£3:34 PM 
rD) (FBI) 
T(FBI) 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


*=□ 

We recently received a request to go up on a pen on an 800 number. Is this possible? 

I also have a box full of JSI J2095‘s and three RDNRs that are reported to be defective. Can you tell me what I 
should be doing with them. Thanks! 

M 1 

UNCLASSIFIED 


UNCLASSIFIED 


b6 

b7C 


l(OTD) (FBI) 


b6 

"b7C' 


[ 


From: 

Sent: 

To: 

Cc: 

Subject: 


]AQ) (FBI) 


Monday . July 19. 2004 5:34 P M 

I ZZjnP) < FBI > 

J ilP) (FBI) 

Use of 3094 to col lect fisa 


UNCLASS IFIFD 
NON-REC ORD 


h ! t rhis is | | I’mthe new TA in Albuquerque. W e recentl y moved into a new building and ! hav e been 

setti ng up our cm p. l'mtrying to get thi ngs going right, now that we are on a new foot so to speak . My dilemma, and I share 
it with most offices, is the col lection of pen data f or fisa and cri minal cases usi ng the JS I 3094. Its pretty easy to keep pen 
data separate f or calea intercepts usi ng the DCS 3000, bypass the 3094, and upl oading it into Telephone A pps. The real 
problem is with hard line col lections where the DNRs f eed di rectly into the 3094. T he only fix would be to set up a dupl ieate 
collection sy stem which would teed di rectly into another 3094 w hich is only used f or fisa cases, k eepi ng the data separate 
from the criminal cases. T alking with my colleagues i ts done di fferent w ays. Most don't set up 2 sy ste m s, theres not 
enough equi pment and i t gets v ery complicated and hard to m anage. Upon tal king with | 1 you are try ing to get a 

mg together to resol ve this issue. He suggested I drop y ou a note to ask for som e guidance on thi s m atter. Thank s 


^meetin g 


UNCLASSIFIED 


b6 

b7C 


9 


. 5 5 


b6 

. b7C 


|(QTD) (FBI) 

From: | |eR) (CON) 

Sent: Wednesday May Jh )\fy 3:22 P M 

To: I l (ER) (FBI) 

Subject: Kt: J3094 SSP Information Needed 



□ 

Need y ou to break this dow n for me (or actually , for the people that w ill be reviewing our SSP). In a 
typical J3094 conf iguration, is there actually a RS-232 cable phy sically connected betw een the DCS- 
3000 and J3094? Also, is this a one or tw o way ex chang e of data? Reg arding the data, w hat sort of 
data is it (i.e., call data)? Is it unclassif ied or classif ied? Sorry to needle y ou on this, but this is the 
level of detail req uired for a C&A, especially when illustrating external connections outside of the 
given accreditation boundary 

Thanks, 


I Icissp 

‘' Dmif aT TC el 1 

(703) | 1 


b6 

b7C 


— O riginal Message 

From ! V ER) (FBI) 

Sent: Wednesday. May 26. 2ft)4 1:59 PM 
To j t ER) (CON) 

Subject: RE: J3094 SSP Information Needed 


S E NSTIIW _BUJ mCFASSIFI E D 
NON-RECORD 


b6 

b7C 


Spoke w ith | Io n this. He said that it is an RS-232 ascii connection that uses the 

ACK/NAK protocol, m other words, the sam e as the DNRs. 


-Original Message— 


— orjai 

Fromr 


□ E R) (CON) 
>72004 1:37 PM 


|E R) (FBI) 

iject: RE: J3094 SSP Information Needed 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 





On question #12, is the DVD/CD driv e on the Dell PC read only , or is it RW? If so, is it 
just the CD f unction or the DVD? 

Sorry if I didn't make m yself clearer on these item s. 

Thanks, 


I ~| cissp 

Digit al Net — . 

C703) | □ 


b6 

b7C 


- — Orjninal Message- — 

Fromq [ER) (FBI) 

Se nt: Tuesday. May 25. 20 04 1:51 PM 
To j [ ER) (CON) 

Subject: 


SENSITIVE Birr UNCLASSIFIED 
NON-RECORD 


b6 ' 

^ 7 0 | | Added som e answ ered to this. W il get the other attachem ents such as the 

iloorpian and sy stem outlines to y ou asap. bd 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 



b6 

■b7C. 


~| (OTP) 


(FBI) 


From: 

Sent: 

To: 

Subject: 


I l (ER) (CON) 

. Wednesday ■ May IL % 1:37 p m 
I I ER) (FBI) 

RE: J3094 S SP Information Needed 


b6 




| |gif (5 KB) 


NON-RECORD 


b7C 


SENSITIVE BUT UNCLASSIFIED 


b6 

b7C 


Thanks f or the updated inf o, | Jl'g also included die accredita tion boundary mem o in hot h the 
original | f ormat, as w ell as j [ ormat if you don't hav e I | By the 

way , did you find any thing out about the connection to or f rom the DCS-3000, in term s of data as w ell 
as ty pe of connection? I'm still waiting on the Headq uarters Certif ication Unit to g et back to m e on 
providing a cony of the DCS-3000 accreditation boundary . In the interim , I’ve inserted the DCS-3000 
outside the j A ccreditation boundary , but need to prov ide more details in the SSP. 

Thanks, 

I H cissp b6 

as r 1 " i b7c 

O riginal Message 

From * H er) (FBI) 

Sent: W^q^ay, May 2 (y 2004 1:17 PM 
To\ |ER) (CON) 

Subject: kt: jjtm SSP information Needed 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


more info. Also sendm e the updated boundry pic so I can add the f lows. 


-—Original Message 

Fromi |ER) (CON) 

Sa nt: ti.ecrkv. May 7S. 20 04 4:00 PM 
To ! I (ER) (FBI) 

Subject: RE: J3094 SSP Information Needed 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


13 



b6 

b7C 


Reg arding question #7 on the J3094 SSP Inf ormation Needed, I need inf ormation for ALL 
hardw are that is to be included w ithin the def ined accreditation boundary . This would include 
modem s, DNRs, RDNRs, USB hubs, COS, J2033, J1033, etc. If it's hardware and w e’ve 
included it w ithin o ur accreditation boundary . we need to list it. Also, f or the PCs w e need the 
model types, such a^ f 

(examples). 

On question #12, is the DVD/CD driv e on the Dell PC read only , or is it RW? If so, is it just the 
CD function or the DVD? b 2 

b7E 

Sorry if I didn't make m yself clearer on these item s. 


From| |ER) (FBI) 

Se nt: Tuesday, May 25, 20 04 1:51 PM 
To: | K ER) (CON) 

Subject: 


SENSITIVE BUT UNCLASSIFIED 


j | Added som e answ ered to this. W il get the other attachem ents such as the f loorplan 
and sy stem outlines to y ou asap. bd 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


b6 

b7C 


[ 


From: 

Sent: 

To: 

Subject: 


~l(OTD) (FBI) 


| I(ITD) (CON) 

. h'nday ■ May 2M. MOw a m 

I I ITD') (FBI) 

RE: J3094 S SP Information Needed 



SENSITIVE BUT UNCLASSIFIED b6 
NON-RECORD £70 


n 

I have the SSP aim ost com pleted, but still need a data f low diag ram , room layout draw ing (the new 
room , Cl 01, that is) of where the eq uipment is to be placed, and any system adm inistration 
docum entation and user g uides f or the J3094. If this is som ething from the vendor, that’s f ine, but we 
need to hav e both a Sy stem Administrator and User Guides. If it’s \endor prov ided, we can just 
reference it in the SSP, and ensure it’s av ailable for inspection during the Certification T est. 

After I get all these thing s, I’ll update the SSP and it should be ready for subm ission. That is, if the 
issue w ith the call records' classif ication doesn't chang e. If it does, then I w ill have to redo the SSP. 


Thanks, 


I t lSSP 

Digital Net . 
(703) 1 1 


b6 

b7C 


Ori ginal Message 

From: 1 k lTD) (FBI) 

Se nt: Thursday, May 27, 2 004 8:43 AM 
To: l I UP) (CON) 

Subject: RE: J3094 SSP Information Needed 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


| | no problem . It is an actual cable connection that dow nloads call record inf ormation from 

the bCS to the 3094. T he com munication is "m ostly " one way . that is the DCS sends a call 
record to the 3094 but req uires and acknow ledgement (ACK) sig nal from the 3094 in order to 
b 6 send the nex t record. This ack does not contain any call record or sy stem information but is just 

b7C an RS-232 data bit that acknow ledges the receipt of the record. As to the classif ication of the 

information I would hav e to assum e that since the DCS-3000 is an unclass if ied sy stem the 
information being sent is the sam e 


— Orii 

From£ 


•ininal Message-- 


>) (CON) 


^Information Needed 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b6 

b7C 


□ 


Need y ou to break this dow n for me (or actually , for the people that w ill be reviewing our SSP). 
In a typical J3094 conf iguration, is there actually a RS-232 cable phy sically connected 
betw een the DCS-3000 and J3094? Also, is this a one or tw o way ex chang e of data? 

Reg arding the data, w hat sort of data is it (i.e., call data)? Is it unclassif ied or classif ied? Sorry 
to needle y ou on this, but this is the lev el of detail req uired for a C&A, especially when 
illustrating external connections outside of the g iven accreditation boundary 


Thanks, 


Digital 1^ 

(703)L 


1 


— original Messaqe-- 

From^ 

Sub] 


Origin; 
it; Wee 


|ER) (FBI) 

2T2004 1:59 PM 
I ER) (CON) 

Subject: RE: J3094 SSP Information Needed 


b6 

b7C 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Spoke w ith j b n this. He said that it is an RS-232 ascii connection that uses the 

ACK/NAK protocol, in other words, the sam e as the DNRs. 


— O riginal Message- 


_J ER ) ( C0N ) 

J2004 1:37 PM 

. J(ER) (FBI) 

Subject: RE: J3094 SSP Information Needed 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b6 

b7C 


Thanks f or the updated inf ol p also included the accreditation boundary mem o, in 


b6 

b7C 


b2 

b7E 



both the orig inal Visio format, as w ell as a Portable Netw ork Graphics f ormat if you 
don't hav e Visio. By the way , did you find any thing out about the connection to or f rom 
the DCS-3000, in term s of data as w ell as ty pe of connection? I'm still waiting on the 
Headq uarters Certif ication Unit to g et back to m e on prov iding a copy of the DCS-3000 
accreditation boundary . In the interim , I've inserted the DCS-3000 outside the J3094 
accreditation boundary , but need to prov ide m ore details in the SSP. 


Thanks, 


Digits 


JlSSP 

□ 


b6 

b7C 


- — Orininal Messaap- — 

From! |ER) (FBI) 
Se nt: Wednesday, Mav 26 . 2004 1:17 PM 
To i t ER) (CON) 

Subject: RE: J3094 SSP Information Needed 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


more info. Also sendm e the updated boundry pic so I can add the f lows. 

O rininal Mpssane 

From: | ] ER) (CON) h 

sent; Tuesday, Mav 25, 2pQ4 *00 pm 

Toj |(ER) (FBI) b 7 C 

Subject: Rfc: J3094 SSP Information Needed 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


□ 


Reg arding question #7 on the J3094 SSP Inf ormation Needed, I need 
information for ALL hardware that is to be included w ithin the def ined 
accreditation boundary . This would include m odem s, DNRs, RDNRs, USB hubs, 
COS, J2033, J1033, etc. If it's hardware and w e've included it w ithin our 
accreditation boundary , we need to list it. Also, f or the PCs w e need the m odel 
type s, such as| ™~’~ ” ’ 

| (exam pies). 

On question #12, is the DVD/CD driv e on the Dell PC read only , or is it RW? If 
so, is it just the CD f unction or the DVD? 

Sorry if I didn't make m yself clearer on these item s. 
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Thanks, 


I]cissp 

Digit al Net 
(703) | H 


--Original 

Fromi 
Sen] 

To£ |[ER) (CON) 

Subject: 


b6 

b7C 


SENSITIVE BUT UNCLASS IFItD 
NON-RECORD 


b6 

b7C 


| | Added som e answ ered to this. W il get the other attachem ents such 

as the f loorplan and sy stem outlines to y ou asap. bd 


SENSITIVE BUT UNCLASSIFIED 


SENS ITI VE PUT UNC LA SSI FIED 


SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 

SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 





SENSITIVE BUT UNCLASSIFIED 
NON-RECORD b6 


Q The Dialed Number Recorders are the equipment that decodes the dialed information along with a date/time 
and other misc call information. They pass that information to the J-3094 which stores it. There are options 
where the user can input target name but not the case number. The is another module which almost no one uses 
which allows the user to input or import more detailed target information. This module is not required by the system 
and can be removed in needed. 


In a majorit y of FO's the DCS 3000 is connected to the system. Specific connection details should be addressed to 

I 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


20 


I have a m eeting with l ~ j at 1 lam this morning to discuss som e speci fie situations w here rul ings need 

to be m ade on cl assi ncation. Before! go I want to m ake sure that I descri be your situation accuratel y. 

The J3094 S ystem collects si gnal tones, conv erts the tones i nto the num eric representati on, and stores that 
information as the P en Regi ster data f or the targeted 1 ine. No voice is collected. The appl ication user has the 
capabi lity, and often uses the capabi Iky, to enter case IDs or other case rel ated i nformation and associ ate that 
information with the P en Regi ster data. T he information is then copi ed onto a di sk to be upl oaded i nto the 
Telephone A pplication. 

If there is a pi an to connect thi s to the DCS 3000 or DCS 5000, please 1 et me know how that connecti on will be 
establ ished. 1 recal 1 seei ng som e com ment on the use of the Cl- 100. 

Respectf ully, 

I ~ I ^6 

CU. IAS . security Uivsion b 7 C 

(202 1 | 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


| |(OTD) (FBI) 

From: 

r iDivll) (CON) 



To: 

| |(ER)(FB1),| 

|(ER) (FBI);| 

|(ER) 

Cc: 

1SE , 1 

|| imivi n rFRrJ 

1 (HD (FBI) 


Subject: 

Discussi on witl| j 

bo 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Gentlem en, 


bo 

b7C 


1 have a m eeting witt i [ at 11am this morning to discuss som e speci fie situations where rulings need to be 

made on cl assi fication. Before I go I want to m ake sure that I descri be your situation accuratel y. 


The J3094 S ystem collects si gnal tones, conv erts the tones i nto the num eric representati on, and stores that i nformation as 
the Pen Regi ster data f or the targeted 1 ine. No voice is collected. The appl ication user has the capabi lily, and often uses 
the capabi lity, to enter case IDs or other case rel ated information and associ ate that i nformation with the P en Regi ster 
data. The information is then copi ed onto a di sk to be uploaded i nto the T elephone A pplication. 

If there is a plan to connect thi s to the DCS 3000 or DCS 500 0. nlease 1 et me know how that connect! on will be 
establ ished. I recal 1 seei ng som e com ment on the use of the| | 


Respectf ully, 


1 1 

itv r 

Jivsion 

CUT 

(202) 


1 1 



SENSITIVE BUT UNCLASSIFIED 


22 



From: 

Sent: 

To: 

Subject 


UNCLASSIFIED 

NON-RECORD 


So far we haven't had any errors since the patch. Thanks! k g 

— Original 

From: 

Sent: 

To: 

Subject: 

UNCLASSIFIED 
NON-RECORD 


Good M orning - W anted to check with you to see how the DCS 3000 patch w as w orking with the J-3094. A re you sti 11 
getting the out of stack errors or locking up? Thanks for the info... bd 


UNCLASSIFIED 


UNCLASSIFIED 





:la) (fbi)J 


TO 

Subject: 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


Good m orning, Wanted to 1 et all of you know that thank s to your assi stance I bel ieve we hav e found the probl em with the 
3094 stack space errors and 1 ock-ups. I am working with the DCS -3000 peopl e to correct the data ti ming from the 3000. 
Hopefully they will be abl e to upload a patch that w ill fix the problem . Another thought: T here has been di scussi on 
concerni ng disconnect ng the DCS 3000 from the 3094 and doi ng the T A upload from the 3000. This would give you the 
cell site info for TA Anv thoughts on thi s? W e may be able to gel JS I to modify the 3094 i f everyone w ants to k eep it there. 
Thank s for the info. I I 


b6 

b7C 


24 





UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 
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From: 

Sent: 

To: 

Subject: 


UNCLASSIFIED 
NON-RECORD 

dZI 

We currentl y used the Upl oad T o TA - Function on the 3094 to i mport to Telephone A pps, how ever since T A is now or will 
becapabl e of also tak mg in cell sites we'll have to use the CDNRS file from the DCS 3000 for all the wireless. Wehadin 
the past had probl em s of illegal intercepts f or FISA cases w hereby we made a copy of the illegal intercept to be seal ed by 
the court and then del eted the records v ia the 3094. A t issue now is the probl em that we'fl also hav e to find and del ete the 
files in the CDNRS file of the DCS 3000 and due f uture T A uploads f rom the 3094 and the DCS 3000 separatel y so that w e 
don't have del eted records on the 3094 show ing up from the DCS 3000. My questi on, if 1‘mgoing in the right direction; do I 
need to phy sically disconnect the DCS 3000 from the 3094? 


UNCLASSIFIED 


E F) (FBI) 
22252:31 P M 

| OTP) (FBI) 


b6 

b7C 
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b6 

b7C 


From: 

Sent: 

To: 

Subject: 


rE- 


|AT) (CON) 

L2005 1:53 PM 
] (OTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


it see 


seems to be running fine. Verified with TTA’s 
Looks good. 


b2 


I 1 

DCSP Atlanta, Sys terns Administrator 
ELSUR Tec hnology Managem ent Unit (ETMU) 

Elec tronic Surveillanc e Tec hnology Sec tion (ESTS) 

Operational Tec hnology Divis ion (OTD) , . 

■ Des k) bD 

S » b7C 

Fax ) 


b6 

b7C 


b6 

b7C 


— Original Me«;«anp— 


I (OTD) (FBI) 

TO. 200 5 7:49 AM, 




S 7:49 . 

C) (FBI)r" 
AT) (COTHQ 


~lF)(FBI) ; r~ 

^jla) (Pbt 


□(SD) (FBlC 


□(IP) 


UNCLASSIFIED 

NON-RECORD 


Good Morning - Wanted to check with you to see how the DCS 3000 patch w as working with the J-3094. A re you still 
getting the out of stack errors or locking up? T hank s for the info... bd 


UNCLASSIFIED 

UNCLASSIFIED 
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r 


From: 

Sent: 

To: 

Cc: 

Subject: 


~[ (OTP) 


(FBI) 


(FBI) 

5 10:17 A M 
ID) (FBI) 

(OTD) (FBI); J_ 


b6 

-b7C- 


JOTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


Thanks for following up. The patch seems to be working great and the addition of the connectivity indicator is very helpful 


— Original Messaoe- 

Froiti: | 


Sent: 

To: 

Subject: 




UNCLASSIFIED 

NON-RECORD 




!I)p5 4:49 AM 

IfcsC) (FBI)I 
_J(AT) (CON)] 




ImiFBn l 
I LA) (FBI) 


](SD) (FBI I | (IP) 


b6 

b7C 


Good Morning - Wanted to check with you to see how the DCS 3000 patch w as working with the J-3094. A re you still 
getting the out of stack errors or locking up? T hank s for the info... bd 


U N CLASSIFIED 

UNCLASSIFIED 
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IOTP) (FBI) 


From: 

Sent: 

To: 


Tuesday . Novem ber* 


KSD) (FBI) 
TT~2005 1:50 P M 


otMT 

R^czzr 


3 


(OTD) (FBO, 
ID) (CO N);! 


j(SD)(FBI)£ 


b6 

b7C 


□(5P) (CQN)I 




») (FBI) 


UNCLASSIFIED 

NON-RECORD 


Thanks for following through. 

No problem running the reports and TA uploads from the DCS3000 as long as it is possible to print reports for all targets, 
with page breaks, like the J3094, from a single selection so as not to have to generate reports individually. Same with the 
TA upload. It would be too time consuming to generate individual upload files for each target. 


--O riginal Message— 


Fromf” 


, 1 (OTD) (FBI) 

Se nt: Tuesday, November 15. 2005 4;31 am 


to£ 


1 (HN) (FBl)[ 


Subject: 


]SD) (FBI) 


□ (SC) (FBIJI 


UNCLASSIFIED 

NON-RECORD 


(IP) (FBI) 
(LA) (FBI) 



b6 

b7C 


] 


Goodjaoming, Wanted to 1 et all of you know that thank s to your assi stance I bel ieve we hav e found the probl em with 
the j t >iack space errors and 1 ock-ups. I amworking with the DCS -3000 peopl e to correct the data ti ming from the 
3O0o. Hopef ully they will be abl e to upload j |t hat w ill fi x the p robl em . Another thought: T here has been 
discussi on concemi ng disco nnect ! ng the DCS 3000 from the | | and doi ng the | j upload fro m the 3000. T his would 
give you the cel 1 site info for | | Any thou ghts on thi s? W e may oe abl e to get JS 1 to modify thef 
wants to k eep it there. ThankTTor the info | | 

b6 
b7C 

UNCLASSIFIED 


UNCLASSIFIED 
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From: I 1 «P> (FBI) b 7 C 

Sent: Tuesday . Decern be ~Q6. 2 005 9:25 A M 

To: I I (OTD) (FBI) 

Subject: RE: 


UNCLASSIFIED 

NON-RECORD 



UNCLASSIFIED 

NON-RECORD 


Good Morning - Wanted to check with you to see how the DCS 3000 patch w as working with the J-3094. A re you still 
getting the out of stack errors or locking up? Thanks for the info... bd 


UNCLASSIFIED 


UNCLASSIFIED 


30 



UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 

□ I forwarded your message to| | Ideally, if we could get cell site 

information from the DCS to the 3094, that would be better. However, I have no 
problem with going to the DCS and doing one upload and then to the 3094 to do 
the rest. 


I have another problem, though. We have a Pen on the below Target, 510| j 
| | I've known f or a lo ng time that for some reason, when this target calls 

certain numbers, an | \ gets added to this number, and then this record is 

rejected in T A. When I first noticed this, I remember discussing this with| | 

and he gave me an explanation. We both have forgotten the reason. Do you have 
any ideas? I'm only asking as the Case Agent is inquiring why a call they know 
their Target made, and which shows up in Voice Box, rejects in Telephone 
Application. See below for an example. I can hand take out the | 1 1 suppose, 

but what a pain in the neck! 

b2 










Good morning, Wanted to 1 et all of you know that thank s to your assi stance I bel ieve we hav e found the probl em with 
the 3094 stack space errors and 1 ock-ups. I am working with the DCS -3000 peopl e to correct the data ti ming from the 
3000. Hopef ully they will be abl e to upload a patch that w ill fix the problem . Another thought: T here has been 
discussi on concemi ng disconnecti ng the DCS 3000 from the 3094 and doi ng the T A upload from the 3000. This would 


give you the cel 1 site info for TA. Any thoug hts on thi s? W e may be abl e to get JS I to modify the 3094 i f everyone 
wants to k eep it there. Thank s for the info.| | 


UNCLASSIFIED 


b6 

b7C 


UNCLASSIFIED 

UNCLASSIFIED 
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Q I forwarded your message to I [ ideally, if we could get cell site 

•mation from the DCS to the 3094, that would be better. However, I have no 
problem with going to the DCS and doing one upload and then to the 3094 to do 
the rest. 

I have another problem, though. We have a Pen on the below Target, 510 | | 

| | I've known foralong time that for some reason, when this target calls 

certain numbers, an □ gets added to this number, and then this record is 

rejected in T A. When I first noticed this, I remember discussing this with □ 
and he gave me an explanation. We both have forgotten the reason. Do you have 
any ideas? I'm only asking as the Case Agent is inquiring why a call they know 
their Target made, and which shows up in Voice Box, rejects in T eleph one 
Application. See below for an example. I can hand take out the 1 1 1 suppose, 

but what a pain in the neck! b2 

b6 

b7C 

Thanks^ b6 b7E 

b7C 






Subject: 


UNCLASSIFIED 

NON-RECORD 


Good m orning, Wanted to 1 et all of you know that thank s to your assi stance I bel k 


hav e found the probl 


with 




thellstack space errors and 1 ock-ups. I am working with the DCS -3000 peopl e to correct the data ti ming from the 

3000. Hopef ully they will be abl e to upload a patch that w ill fix the p roblem . Anoth er tho ught: T here has been 

discussi on concerni ng disconami ng the DCS 3000 from th j l and doi ng the l l ipload fro m the 3000. This would 
give you the cel 1 site info foi l | Any thoug hts on thi s? W e may be abl e to get JS I to modify th j | i f everyone 

wants to k eep i t there. Thant s for the info ) | 


UNCLASSIFIED 


b6 

b7C 


UNCLASSIFIED 





| (OTP) (FBI) 

From: I l (LA) (FBI) b6 

Sent: Wednesday . November 16 . 2005 4:01 PM K7P 

To: | K OTD) (FBI) 

Subject: RE: 


UNCLASSIFIED 

NON-RECORD 


Hellol | 

In reference to disconnecting the dcs from the 3094, it is better for us if we stay connected to the 3094. The criminal 
cellualr lines are located at our main office and flow into our 3094 via bridge route. There is also a hub that sends both the 
NSD and the criminal data into the 3094. It is in one convenient location and the agents like the format that is printed out. 
Thanks, 

b6 
b7C 


TTT| 


O riginal Message 

From ! 


□ (OTD)(FBI) 


rial Li 

HN) (FBI); 

IIP) (FBI) 

1 1 

(SC) (FBI); 

ILA) (FBI) 


Su B ject : 



b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


Good m orning, Wanted to 1 et al 1 of you know that thank s to your assi stance I bel ieve we hav e found the probl em with 
the 3094 stack space errors and 1 ock-ups. I am working with the DCS -3000 peopl e to correct the data ti ming from the 
3000. Hopef ully they will be abl e to upload a patch that w ill fix the problem . Another thought: T here has been 
discussi on concerni ng disconnecti ng the DCS 3000 from the 3094 and doi ng the T A upload from the 3000. This would 
give you the cel 1 site info for TA. Any thou ghts on thi s? W e may be able to get JS I to modify the 3094 i f everyone 
wants to k eep i t there. Thank s for the info| | 


UNCLASSIFIED 


b6 

b7C 


UNCLASSIFIED 


37 





□ 


this is what I was talking to you about at the breakfast meeting. Either we get FISA unit down here, or 
we need to get this worked out!! 


go up there, 


Original Message 

From ! I (UD) (FBI) 

Se nt: Wednesday. Au gust 04, 20 04 2:01 PM 
To: | | crrD MFBi);| 

Subject: RE: Results fron| fleeting 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


I would agree that we need official guidance on this. This is the same old question that has been posed for three years 
now i.e. at what point does it become classified? As to the tempoary storage of the FISA data making it classified I 
must refer to the other systems that do the same thing. DCS 3000 is not a classified system but does temporarily 
store FISA information as does the fax intercept and pager systems! If the 3094 is deemed a classified system then 
all of the other systems would have to be re-CA'd. Additionally, All of the DNR's temporarily store data no matter 
where they are located. That is, they will store the FISA data in a 2033 located in an RA and download that information 
to the 3094 at night. One more aspect to consider is the cost effect. If we cannot do FISA pens with RDNRs anymore 
then the other option is leased lines and 24/7 long distance calls. 

Original Mpssflflfo=j 

From! [UD) (FBI) 

Se nt: Wednesday. Augu st 04, 2004 1:35 PM , 

To J rUD)(F8I)| [ UP) (FBI) D ° 

Subject: FW: Results fronn | | Meetinq b 7 C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b6 


b7C 


I was speaking witt j | 

together and complete this task 


regarding another matter when this one came up. Please review and let's get 


Thanks, 



Messaae- 


b6 

b7C 


From:jj 
Sei 
To: 


il Message-- 


l. 


Wednesday. / 


JlTD) (FBI) 


Subject: RE: Results from 


ugust 04, 2004 12:58 PM 

Irrm uFBn 


J4eeting 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


b6 

b7C 


I would recomm end that vnu see k official written guidance from l b ursuant to and based on the 

below email frorr j I It seems a little like splitting hairs between "transmission to" the J3094 box and 

"received by" the box. But the way I read it: protection is not required only DURING transmission--e.g. encryption 
not required for transmission eg., from phone co to our box or while it’s temporarily residing in the RDNR. 

BUT from the moment the data hits the J3094 located in the FO/RA space then the data is classified and requires 
protection-even while it simply resides in the J3094 box-as temporarily as that might be. Practically speaking, I'm 
not sure how you can accomplish the requirements for marking, storing, and handling of the classified information 
as soon as it comes into the box-without designating a box for FISA pen/trap collections. I would recommend 
seeking clarification on that ; i.e., getting a definitive answer that while the information resides in the J3094 what 
requirements must be complied with to protect it as SECRET. 


PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI WITHOUT PRIOR 
OGC APPROVAL 


Assistant General Counsel 

b2 

Science & Technology Law Unit 

b6 

Engineering Research Facility 

Bldg. 27958A Room A-207B 

b7C 

Quanticp Va ‘22135, 


Tel: 701 L 


Fax 703L L. 


Daaer 888 ! 



SCIENCE & TECHNOLOGY LAW UNIT - OFFICE OF THE GENERAL COUNSEL 


— O riginal Message — 

From ! I UTD) (FBI) 

Sent: Wednesday, Auqust 04, 2004 11:55 AM 

To: | OTD UFBI) 

Subject: FW: Results from | | Meeting 


b6 

b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Hello ) | 

Enclosed is one of several e-mails I received fromf 
think! L 


] Let me know what you 




b6 

b7C 



• 

»• 


2 

b7C 




Fromf 

IfDivll) (CON) 


Sent: Monday, May 10, 2004 1:16 PM 


Tori 

[ER) f FBI) J 

KER) (FBI);| 

Cct" 

K^( p Bi);l 

|(Divll) (FBI) 


Subject: Results (’ron f M eeting' 


](ER) (FBI) 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Gentl em en, 

I spoke to ! l today and was abl e to get sotn e better i nformation regardi ng how to handl e the 

information collected by the DNR(s) and RDNR(s). 

Techni cally, if the information is gathered pursuent to a FIS A collection order, it is classi lied regardi ess of 
whether i t is associ ated w ith a FIS A case or not. T hat bei ng sai d, there are som e extenuati ng issues. 
Information gathered duri ng a field collection activity, meaning that it is not done f rom the physical location of 
the FO/RA , e not requi red to be, and shoul dn't be, subjected to the phy sical storage requi rements ty pically 
provided at the FO/RA until it is actual ly sent/brought to the FO/RA . Taht is to say that if an agent i s in the 
field and records i nformation related to a FIS A order, that information shoul d be secured to extent possi ble, 
but does not need to be m arked as S ECRET, or stored in a saf e, or double wrapped duri ng transi t, until it is 
sent/brought to the FO/RA . Upon arrival at the FO/RA , or other OVERT FBI lacility, the data m ust then be 
appropri atel y marked, stored, and handl ed in a manner appropri ate to its classi fication. 

How's THAT for a run-on sentence? 

So basi cally, what this means to y ou, for FISA collections, is: 

When the i nformation is si tting in a RDNR, waiting to be transm itted, it is not requi red to be encry pted or 
protected as S ECRET. It s NOT required to be encry pted DURING transm ission TO THE FO/RA WHERE the 
J3094 i s located. How ever, AFTER it is recei ved by the J3094 A T the FO/RA , or other OVERT FBI lacility, it 
must then be protected as S ECRET. The sy stem on which it is stored shoul d be label ed as contai ning 
SECRET data and A LL output that contai ns information relating to a FIS A case m ust be m arked as S ECRET. 
Additionally, the system and any hardcopy output and storage m edia must be m arked, stored, and handl ed as 
SECRET. 

It is my understandi ng that the CM P provides an appropri ate level of physical protection for the storage f o 
SECRET information, 

I ask ed about the argum ent that pen regi ster data f rom a FIS A case i s indistinguishabl e from pen regi ster data 
from a criminal case. T he answ er to that is. ..It doesn’s m atter. The reason i s that i f the information about the 
number, and the di aled num bers, was com promised, you coul d determ ine who teh target w as and w ho the 
target w as deal ing with, and ev entual ly determ ine that the reason f or the tap w as ci rminal or FISA related. 

That m ay not be possi ble in every case, but i n enough to w arrant the cl assi fication. 


OK, now that I have said all that. If you want official written guidance. P lease contact! |and 

request a w ritten response. 

Respectf ully, 


CU, IASj_Securitv Divsion 
(202 H I 


b6 

b7C 



SENSITIVE BUT UNCLASSIFIED 








b6 

b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 


~l(OTD) (FBI) 


I f lTD) (FBI) 

Tuesday . July 20. 2004 9:08 A M 
I I^QUFRH 


L 


JlTD) (FBI) 


UNCLASSIFIED b6 

NON-RECORD ^70 


hQ 

Thanks fo 


Thanks for the email. I am hoping that we can get some answers for you and the rest of the field very soon. We are in the 
midst of trying to get a meeting with representatives from the FISA unit to get some resolution to this problem. We will 
keep you in the loop as to what is happening and what direction(s) we need to take. 


— original Message- — 

From ! 

Se nt: Monday, July 19. 2 004 
To ] r iTD) (FBI) 

Ccj IflTD) (FBI) 


JQ) (FBI) 
5:34 PM 


b6 

b7C 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


This is l I I'mthe new TA in Albuquerque. W e recentl y moved into a new building and I hav e been 

setting up our cm p. I’mtrying to get thi ngs goi ng right, now that we are on a new foot so to speak . My dilemma, and I 
share i t with most offices, is the col lection of pen data f or fisa and cri minal cases usi ng the JS I 3094. Its pretty easy to 
keep pen data separate f or calea intercepts usi ng the DCS 3000, bypass the 3094, and upl oadi ng it into Telephone 
Apps. The real problem is with hard line col lections where the DNRs f eed di rectly into the 3094. T he onl y fix would be 
to set up a dupl icate col lection system which would feed di rectly into another 3094 w hich is only used for fisa cases, 
keepi ng the data separate f rom the criminal cases. T alking with my colleagues i ts done di fferent w ays. Most don' t set 
up 2 sy ste m s, theres not enough equi pment and i t gets v ery complicated and hard to m anage. Upon tal king with | j 
| | you are try ing to get a m eetin g together to resol ve this issue. He suggested I drop y ou a note to ask for som e 

guidance on thi s m atter. Thank s| j 


UNCLASSIFIED 


42 




UNCLASSIFIED 


□ 

Thanks f or taking a look at m y questions. In reg ards to the PT T data, w e do not collect pen data on 
voice box and w e do not use a VBIII f ile to upload to T A. Per the instructions I e-m ailed to y ou, we 
use the DCS 3000 T race f ile. Thus far, it has w orked for us. Also, other than the issue w ith the 6 
second hang time, the issues y ou m entioned in the conf erence hav e been enum erated in m y upload 
instructions. I w ill add an ex planation reg arding the 6 second hang time. Reg arding the issue w ith 
Alerts; at this tim e if a call does not hav e a stop tim e and stop date it w ill not upload to T A. The 
successf ul alerts, how ever, do upload. I w ill take a closer look at how the alerts appear in T A. I'm 
not sure one can disting uish in T A if a call is an alert or an actual answ ered call. If not I will modify 
my instructions to ex plain this issue too. I w ill review our uploads and let y ou know . Thanks ag ain for 
your input, it has been v ery helpful. 


The case ag ents are w ell aware of the Ex cel spreadsheet f or PTT data and hav e found it very useful. 

However, as y ou know , they use T A to find links and associations w ith other cases across the 
country . Theref ore, they still try to get the PT T data into T A. Prior to being able to do uploads they 
were m anually typing in each call. T he problem with this was no consistency . Each ag ent was 
using different f ields for the data and som e were not putting the data in T A at all. Now that T A has 


43 


been m odified hopef ully there w ill be som e consistency 


However, it is s till muc h m ore cum bersom e than using the 3094. T heref ore, now that T A has been 
modified, I hop j ] :an look into the possibility of using the 3094 to upload PT T data. Also, now 
that T A will accept cell site inf ormation we hope the 3094 can be m odified to accept this data. Let us 
know . 

b6 

Thanks, b7C 

tta | I 

— Or iginal Message — 

From:f |OTD) (FBI) 

Se nt: Monday. M5V U L 2UU5 10:19 AM 
TO (FBI) 

Subject: Kt: "FA Modifications 


UNCLASSIFIED 

NON-RECORD 


b6 

b7C 


ticked at the i nstructi ons you attached. 1 don’t hav e access to T A so I am unabl e to go through 
the procedures. T here are tw o issues to address here and I w ould like to m ake sure ev eryone k eeps 
them straight. 

Frst, is the P TT upload. The P TT data w as a source of data that unti 1 recent] y had no 
way for TA to provide anal ytical assi stance to agents. T he DCS 3000 has had an output 
file av ailable for som etime bei ng used w ith spreadsheets.T he nature of the data i s conf using due 
to use of IVEI and UFMI identifiers for Associ ates (as opposed to tel ephone num bers.) Even 
farther there are sev eral call scenari os that I cauti on ev eryone on. There is the 6 second hang 
time, which means i f an Associ ate does not repl y within 6 seconds the subsequent com munication 
attem pt betw een the T arget and the A ssoci ate w ill generate a new unique cal 1 record. Next, there i s 
the interpretati on of what an A lert message shoul d be consi dered. If I alert you 100 times does thi s 
consti tute 100 cal Is as f ar as a 1 egal interpretati on. Another consi deration is what output f ormat is bei ng 
generated by the VB III system . Before anyone upl oads to T A from VB III an understandi ng of the time 
stam ps and other m ethods used to deri ve the data m ust be understood. 

The S econd i ssue i s the 3094 usage. I enum erated the techni cal issues at the T 1CTU Conference 
and that presentati on is o n the T ICTU w ebsi te. I don’t loinw nf anv nians for the 3094's f uture. That 
would have to addressed to l | group f or the VB o j I group for the 3094. 

Historically, when C A LEA began i t was thought that the V B would be doing pen regi sters. I think 
there are som e offices w hich hav e tried this, however, there are seri ous v olume concerns w ith how 
the VB will operate i f pushed too f ar. Iam not the expert on the V B's capaci ty or what form a 
TA uploadabl e output w ould take. 1 do caution that any VB output upl oad shoul d be understood 
by the field personnel performing this acti on. What would be the ti mestam ps, durati on cal culation 
param eters and w ill IAPSystem identity be captured? 
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I do feel these questi ons issues need di scussi on, otherwise I wouldn't have brought them up in my 
presentati on at the Regi onal conferences. W e are schedul ting an internal unit meeting to discuss these 
issues m ore and I w ill keep y ou up to date on w hat I find out. 


[=1 
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NON-RECORD 


b6 

Hi | | b7C 

Congratulations on getting the | |j ob. 

Could you give me a little more detail on what the field sees as the issue(s) that need to be resolved? I think there are 
probably some policy people in OGC who should also be involved, but I need to understand the issue a little better first. 



I am I I newly assi gned | | for the Telecom munications Intercept and Col lection Technol ogy 

Unit (TICTU) at ERF. This unit is responsi ble tor providing electronic surveillance equi pment to all FBI field offices. 
This equi pment ranges f rom the 1033 uni t, the 3094, facsi mile intercept equi pment, the DCS -3000 (sw itched based 
equipment), the DCS -5000 (FIS A platform), and the DCS -6000 (criminal platform). I am contacti ng you to schedul e a 
meeti ng of all parties 1 isted i n the cc: (and any you deem necessary ) to meet here at E RF and w ork towards w ritten 


46 




SENSITIVE BUT UNCLASSIFIED 


■47 



■ 



b6 


[ 

” |(OTD) (FBI) 


h7r. 


From: 

1 1 

(ITD) (FBI) 



Sent: 


05. 2004 10:16 A M 



To: ; 


l(OGC) (FBIi 



Cc: 1 


FTecDl (CON)J 

1 ('Tint I'FRIi-l 



(ttu; (t-m)i 


[ITDl fFBnl 

riTDl (FBI); 

1 

1 

|ul>) (mini 

IITD) (FBI)I 

_JITD) (FBI); 


Subject: Pen Regi ster, 3094, Telephone A pplications 
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I I 

I am i I newly assi gned l I for the Telecom munications Intercept and Col lection Technol ogy Unit 

(TICTU) at ERF. This unit is responsi ble for providing electronic surveillance equi pment to al I FBI field offices. This 
equipment ranges f rom the 1033 uni t, the 3094, facsi mite intercept equi pment, the DCS -3000 (sw itched based 
equipment), the DCS -5000 (FIS A platform), and the DCS -6000 (criminal platform). I am contacti ng you to schedul e a 
meeting of all parties listed in the cc: (and any you deem necessary ) to meet here at E RF and w ork towards w ritten 
guidance w ith the 3094 FIS A incoming data and w hat cl assi fication before telephone appl ications. 

TICTU is currentl y receiving increased com munications from the field offices as to the di rection to follow. I am providing 
two possi ble dates to m eet: Thursday , August 26, at 10:00 a.m . or Friiay , Septem ber 3rd at 10:00 a.m . Please adv ise of 
the date v ou pr efer, and if additional information is needed bef ore we meet. I can be contacted v ia e-m ail or by telephone 
703 1 1 1 aw ait your response. 

i ~ z n 
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Guys, 

The q uestion continues to pop-up, how does the f ield handle FISA inf ormation; classif ied. or 
unclassif ied? Can w e dev elop a procedure reg arding the proper handling and transf er of data thru 
the DCS-3000 One W ay Push into the 3094? Or use an alternate approach? 

r I mentioned the possibility of using EDMS for each reg ion and autom ajically download the 
Tel Apps. T his m ay be a v iable option? More details w ill be need f or a discussion. 

Other sug gestions? Any way to prov ide the f ield with an answ er? 
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— Original Message 

From j P D) (FBI) 

Se nt: Thursday. May 2 /, 2004 2:35 PM 

To J I OTP) (FBI) | | OTD) (FBI) 

Subject: 
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SENSITIVE BUT UNCLASSIFIED 


Sent: Monday, May 10 , 200 4 8:44 AM 

To: | | (ER) (FBI)f 


Subjec t: Discuss ion withL 


SENSIITVE BUT UNCLAS SIFIED 
N ON-REC ORD 


I have a meeting witti 

to be made on class incacion. 


lat 1 1am this morning to discuss some specific situations where rulings need 

tiore I go I want to make sure that I desc ribe your situation a ccurately. 


The J30 94 System collects s ignal tones, converts the tones into the numeric representa tion, and stores tha t 
informat bn as th e Pen Reg ister d ata for the targeted line . No voice is collecte d. The applicatbn user h as the 
capab ility, and often uses th e cap ability, to enter case IDs o r othe r case related information a nd ass ociate that 
informat bn with the Pen Reg iste r data . The informatbn is the n copied onto a disk to be uploaded into the 
Telephone Application. 

If there is a plan to connect this to the DCS 3000 or DCS 5000, please let me know how that connection will be 
establi shed. I recall see ing some comm ent on the use o f the Cl- 100 . 


SENSITIVE BUT UNCLASSIFIED 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-14-2007 BY 6 5 1 7 9DHH/ K5R/HA J 


10/4/2006 


' Message 
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From: 

Sent: 

To: 

Cc: 


|(OTD) (FBI) 
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I [eR) (FBI) 


b7C 

Monday, May 10 , 2004 8:53 AM 



| (Divll) (CON) 

|(ER) (FBI);[ 

|(ER) (FBI) 

|(Divll) (FBI) 

|(ER) (FBI) 


;: RE : Discuss ion with| 
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NON-RECORD 

I i lhe Dialed Number Recorders are the equipment that decodes the dialed information along with a 
date/time stamp and other misc call information. They pass that information to the J-3094 which stores it. There 
are options where the user can input target name but not the case number. The is another module which almost 
no one uses which allows the user to input or import more detailed target information. This module is not required 
by the system and can be removed in needed. 


In a major ity of FO’s the D CS 3000 is connected to the system. Specific connection details should be 
addressed tq |ERF) 


O riginal Message 


From| |(Divll) (CON) 


Sent: Monday, May lb, 2604 8:44 AM 


To* I (ER) (FBI) J 

LER) (FBI)f“ 

cd l(Divll) ?F61)1 

PR) (FBI) 

Subject: Discussion with| i 


]ER) (FBI) 
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SENSITIVE BUT UNC L ASS MED 
NON-R ECORD 


Gentlemen, 

I have a meet ing with l | a t 11am this morning to discuss s ome specific situations where 

rulings need to be made on classi fication. Before I go I want to make sure th at I descr ibe your situation 
accurately. 


The J30 94 System collects s ignal tones, converts the tones into the numeric representa tion, and stores 
that information as the Pen Reg ister d ata for the ta rgete d line. No voice is collected. The a pplication use r 
has th e capa bility, and often uses the capa bility, to enter case IDs or other case re lated information and 
ass ociate that information with the Pen Register data. The infoimation is then copied onto a disk to be 
upload ed into the Te lep hone App lication. 

If there is a plan to connect this to the DCS 3000 or DCS 5000, please let me know how that connection 
will be e stablishe d. I recal 1 see ing some com men t on the use o f the Cl- 100 . 


Respectfu lly, 




tu, 

curly yivsion 

(202] 
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| "[ OTP) (FBI) 

From: | | (Divll) (CON) 

Sent: Monday, May 10 , 2004 8:56 AM 

To: \ [ER) (FBI) 

Subjec t: RE: Discuss ion witi|_________ 

SENSITIVE BUT UNCLAS S 1HED 
NON-RECORD 

~ Z Z1 

Thanks for the clarifications. 
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Respectfu lly. 


I 

V IAS. Security Divs 

1 

Origin 

From:l 
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U(ER) (FBI) 

Sent: Monday, May 10, 2004 8:53 AM 
' Wll) (CON)J“ 

|g yn) i FB iin 


>ject: Rt: Discussion v 


□ (ER) (FBI)C 
JER) (FBI) 


□(ER) (FBI) 


SENSITIVE B UT UNCLASSIFIE D 
NON-REC ORD 

jlhe Dialed Number Recorders are the equipment that decodes the dialed information along with a 
»7fime stamp and other misc call information. They pass that information to the J-3094 which stores it. 
There are options where the user can input target name but not the case number. The is another module 
which almost no one uses which allows the user to input or import more detailed target information. This 
module is not required by the system and can be removed in needed. 

In a majo rity of FO’s the D CS 3000 is connected to the system. Specific connection details should be 
addressed tc | fr ERF) 
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I have a 
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t 11am this morning to discuss s ome specific situations 
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where rulings need to be made on classification . Before I go I want to make sure t hat I describe 
your situation a ccura tely . 

The J30 94 System collects s ignal tones, converts the tones into the numeric representa tion, and 
stores that information as the Pen Register data for the targete d line. No voice is collected. The 
app lication user has th e capa bility, and often uses the capa bility, to ente r case IDs or other case 
related information and associate that information with the Pen Re gis ter data . The information is 
then copied onto a disk to be uploaded into the Telep hone Application. 

If there is a plan to connect this to the DCS 3000 or DCS 5000, please let me know how that 
conne ction wil be estab lished. I recall seeing some comm ent on the use of the CI-100 . 


Respectfu lly, 
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| ~| (OTP) (FBI) 

From: I i Divl 1 ) (CON) 

Sent: Thursday, May 06 , 2004 8 :43 AM 

To: I p iv 09) (FBI) 

Cc: j lrF.RUF BI) J , 

I | (ER?(I-BI) | 

Subjec t: Pen register da ta for FISA related collection 
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Sorry to keep bothering you, but you’ve always come th rough forme in the past. Ihad a meeting on Tuesday 
(May 4) with the othe r add ress ees of this e -mail abo ut a system which coll ects Dialed Numbers on a target line. 
A question came up about the classification of the pen register information (no voice) if the tap is a FISA 
collection. It is my unders land ing that the infoimation is no t classified until it s a ssociated with a FISA case id, 
but I defer the decision to you since I don't really have the authority to make a decis ion on this . 


The pen register information is copied to a disk an d then uploaded to the Telephone Application later. 
Respectfu Uy, 

CU, IAS, Security Divsion 

(202) 383- | | b7C 
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